EUVD-2026-80099
GHSA-2g6g-5w2g-6pf8
Severity by source
AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N
Primary rating from Vendor (Wordfence).
CVSS VectorNVD
Lifecycle Timeline
2DescriptionNVD
The WP-Lister Lite for eBay plugin for WordPress is vulnerable to Stored Cross-Site Scripting via AJAX Cron Handler Request Parameter in all versions up to, and including, 3.8.9 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
AnalysisAI
Unauthenticated stored cross-site scripting in the WP-Lister Lite for eBay WordPress plugin affects every release up to and including 3.8.9, allowing an attacker to inject arbitrary JavaScript through the plugin's AJAX cron handler request parameter because input is not sanitized and output is not escaped. The injected payload is persisted and executes in the browser of any user — including administrators — who later views the affected page, enabling session theft, credential harvesting, or full site takeover via an admin session. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Wp Lister Lite For Ebay
View allImproper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WP Lab WP-Lister L
SQL Injection in WP-Lister Lite for eBay (WordPress plugin, all versions ≤ 3.8.8) allows authenticated attackers holding
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today