What is the CVSS score of CVE-2026-4259?

CVE-2026-4259 has a CVSS 3.1 base score of 7.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L. EPSS exploitation probability: 0.1%.

Which versions of Ultimate WooCommerce Auction Pro are affected by CVE-2026-4259?

Ultimate WooCommerce Auction Pro plugin (all versions through 2.4.5) poses a security risk that could allow attackers to compromise administrator accounts through deceptive links.

Is there a public PoC exploit available for CVE-2026-4259?

Yes, a public proof-of-concept exploit is available for CVE-2026-4259. Prioritise patching immediately. EPSS: 0.1%.

How to fix or mitigate CVE-2026-4259?

Within 24 hours: inventory all WordPress installations running Ultimate WooCommerce Auction Pro and disable the plugin on non-critical instances to eliminate exposure immediately. Within 7 days: implement web application firewall rules to block the vulnerable parameter, establish monitoring for exploitation attempts using known POC signatures, and notify all site administrators of the risk and interim mitigations. Within 30 days: monitor vendor advisory channels for patch release (expected version 2.5.0 or later), test the patch in a staging environment upon availability, and coordinate deployment across all production sites; alternatively, evaluate whether the plugin's functionality can be replaced by a maintained alternative.

Ultimate WooCommerce Auction Pro CVE-2026-4259

EUVD-2026-38212 HIGH

Cross-site Scripting (XSS) (CWE-79)

2026-06-22 WPScan

GHSA-g944-p6hc-2mch

XSS WordPress Ultimate Woocommerce Auction Pro

7.1

CVSS 3.1 · Vendor: WPScan

Severity by source

Vendor (WPScan) PRIMARY

7.1 HIGH

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L

vuln.today AI

6.1 MEDIUM

Reflected XSS needs no attacker auth (PR:N) but requires admin to click (UI:R); script runs cross-context (S:C) with limited confidentiality/integrity impact and no realistic availability impact (A:N).

3.1 AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N

Primary rating from Vendor (WPScan).

CVSS VectorVendor: WPScan

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

Low

Lifecycle Timeline

Analysis Generated

Jul 22, 2026 - 21:14 vuln.today

CVE Published

Jun 22, 2026 - 06:00 cve.org

HIGH 7.1

CVE Published

Jun 22, 2026 - 06:00 cve.org

UNKNOWN (no severity yet)

DescriptionCVE.org

The ultimate-woocommerce-auction-pro WordPress plugin through 2.4.5 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin

Articles & Coverage 2

News 3 New WordPress Vulnerabilities - 3 High Severity, All With POC Jun 23, 2026 News 3 New WordPress Vulnerabilities - 3 High Severity, All With POC Jun 22, 2026

AnalysisAI

Reflected Cross-Site Scripting in the Ultimate WooCommerce Auction Pro WordPress plugin (all versions through 2.4.5) allows remote attackers to inject arbitrary JavaScript into a page by tricking a logged-in high-privilege user, such as an administrator, into clicking a crafted link. The flaw stems from an unsanitized, unescaped request parameter reflected back into the response, and publicly available exploit code exists (reported by WPScan), though EPSS probability is low (0.15%, 4th percentile) and there is no evidence of active exploitation.

Technical ContextAI

The affected component is Ultimate WooCommerce Auction Pro, a commercial WordPress/WooCommerce plugin that adds auction functionality to online stores. The root cause is CWE-79 (Improper Neutralization of Input During Web Page Generation): a user-controllable parameter is echoed directly back into the HTML response without sanitization or output escaping, so an attacker-supplied string is interpreted as active markup/script by the victim's browser. Because this is reflected (non-persistent) XSS, the malicious payload is delivered in the request itself (typically a URL query parameter) rather than stored server-side, and executes in the security context of the WordPress admin session that renders it. The CPE (cpe:2.3:a:unknown:ultimate-woocommerce-auction-pro) confirms the plugin as the affected product across all versions up to and including 2.4.5.

RemediationAI

No vendor-released patch version is identified in the available data, so update to a release later than 2.4.5 as soon as the vendor publishes a fixed build and monitor the WPScan advisory (https://wpscan.com/vulnerability/a98d234b-11e8-4a07-8593-982d656a4fd3/) and NVD entry (https://nvd.nist.gov/vuln/detail/CVE-2026-4259) for the fix version. As compensating controls until a patch is available: deploy a WAF or WordPress security plugin with XSS request filtering to block reflected-payload patterns on the plugin's endpoints (trade-off: rule tuning needed to avoid false positives on legitimate auction parameters); enforce that administrators never click untrusted links and access wp-admin only from a dedicated browser/session (reduces the UI:R attack surface but relies on user discipline); restrict administrative access by IP allowlist where feasible; and set a restrictive Content-Security-Policy that disallows inline script execution to blunt reflected payloads (trade-off: may break theme/plugin functionality that relies on inline scripts, so test before enforcing). Consider deactivating the plugin if auction functionality is non-essential and admin exposure is a concern.