EUVD-2026-38211
GHSA-gxfr-4w92-cm52
Severity by source
AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Network-delivered reflected XSS needs no attacker credentials but mandates admin click; scope changes as script runs in the authenticated browser context beyond the plugin's own trust boundary.
Primary rating from Vendor (WPScan).
CVSS VectorVendor: WPScan
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Lifecycle Timeline
3DescriptionCVE.org
The ultimate-woocommerce-auction-pro WordPress plugin through 2.4.5 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin
AnalysisAI
Reflected Cross-Site Scripting in Ultimate WooCommerce Auction Pro (≤2.4.5) enables unauthenticated remote attackers to inject arbitrary JavaScript into the browsers of high-privilege WordPress users, including administrators, by delivering a crafted URL containing an unsanitized parameter. Scope changes (S:C in CVSS) mean the injected script executes in the victim's browser session context, enabling session hijacking, credential theft, or unauthorized administrative actions. A public proof-of-concept is available via WPScan, though EPSS remains very low at 0.15% (5th percentile) and SSVC reports no confirmed active exploitation.
Technical ContextAI
The vulnerability resides in the ultimate-woocommerce-auction-pro WordPress plugin, a premium extension that adds auction functionality to WooCommerce-powered online stores. The root cause is a failure to sanitize and HTML-encode user-supplied input before reflecting it in the HTTP response - a classic CWE-79 (Improper Neutralization of Input During Web Page Generation / Cross-Site Scripting) pattern. Although CWE is listed as N/A in the source data, the description and CVSS vector are unambiguous indicators of reflected XSS. Affected CPE is cpe:2.3:a:unknown:ultimate-woocommerce-auction-pro:*:*:*:*:*:*:*:* covering all versions through 2.4.5. The CVSS scope metric S:C reflects the browser trust boundary crossing inherent to XSS - the script executes in a security context (the victim's authenticated session) that differs from the vulnerable component itself.
RemediationAI
No vendor-released patch with a confirmed fix version has been identified in the available intelligence at time of analysis - affected versions are confirmed only up to 2.4.5. Site operators should monitor the WPScan advisory at https://wpscan.com/vulnerability/bd44396a-7723-4876-a9c6-266442879bcb/ and VulDB entry https://vuldb.com/vuln/372651 for patch availability and upgrade immediately upon release. As compensating controls pending a patch: disable or remove the ultimate-woocommerce-auction-pro plugin if auction functionality is non-essential (eliminates attack surface entirely); deploy a Web Application Firewall rule to filter reflected XSS patterns on plugin-served pages (trade-off: WAF bypass is possible with encoding tricks); and restrict administrator accounts to trusted IP ranges or VPN access to reduce the attack surface for social engineering delivery (trade-off: operational overhead). Educate administrators to treat unsolicited links to WordPress admin or plugin pages with suspicion.
Share
External POC / Exploit Code
Leaving vuln.today