WooCommerce Simple Auctions CVE-2026-42635

Exploitation requires an attacker to deliver a crafted input/link that is reflected into a WooCommerce Simple Auctions plugin page (versions <= 3.0.10) and to convince a victim to load it - the UI:R metric confirms this user-interaction requirement is the primary limiting factor. No authentication is needed (PR:N), so any internet-facing WordPress site running the vulnerable plugin is reachable, but the site must have the WooCommerce Simple Auctions plugin installed and active, and the payload only yields impact in the browser of a user who interacts with the malicious link. Highest-value outcomes depend on targeting an authenticated administrator, which further narrows realistic abuse.

This is a reflected/unauthenticated Cross-Site Scripting flaw (CWE-79) in the WooCommerce Simple Auctions WordPress plugin, scored CVSS 7.1 (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L). The vector signals favorable to an attacker are network reach (AV:N), low complexity (AC:L), and no privileges required (PR:N), but exploitation is gated by required user interaction (UI:R) - a victim must click a crafted link or visit a malicious page, which is typical of reflected XSS and caps real-world severity below critical. The scope change (S:C) and only Low C/I/A impacts reflect that code executes in the victim's browser context rather than directly compromising the server. No EPSS score, CISA KEV listing, or public POC was provided in the intelligence, so there is no evidence of active exploitation or weaponization - this appears to be a vendor-researcher-reported issue (Patchstack) rather than an urgent in-the-wild threat. Net assessment: a legitimate medium-to-high severity web vulnerability worth patching promptly for exposed storefronts, but not a drop-everything priority absent exploitation signals. Note the Low confidentiality/integrity impacts plus UI:R mean the 7.1 is driven substantially by the scope change; the practical risk is session/credential theft or admin-targeted actions via social engineering, not unauthenticated server takeover.

An attacker crafts a URL or input that injects malicious JavaScript into a WooCommerce Simple Auctions page, then lures a store visitor or administrator into clicking it. When the victim loads the page, the script executes in their browser session, enabling cookie/session theft or forced actions in the site context. No public exploit code was identified, and the required user interaction (UI:R) means the attack depends on successful social engineering.