Ultimate Woocommerce Auction Pro
Monthly
Reflected Cross-Site Scripting in the Ultimate WooCommerce Auction Pro WordPress plugin (all versions through 2.4.5) allows remote attackers to inject arbitrary JavaScript into a page by tricking a logged-in high-privilege user, such as an administrator, into clicking a crafted link. The flaw stems from an unsanitized, unescaped request parameter reflected back into the response, and publicly available exploit code exists (reported by WPScan), though EPSS probability is low (0.15%, 4th percentile) and there is no evidence of active exploitation.
Reflected Cross-Site Scripting in Ultimate WooCommerce Auction Pro (≤2.4.5) enables unauthenticated remote attackers to inject arbitrary JavaScript into the browsers of high-privilege WordPress users, including administrators, by delivering a crafted URL containing an unsanitized parameter. Scope changes (S:C in CVSS) mean the injected script executes in the victim's browser session context, enabling session hijacking, credential theft, or unauthorized administrative actions. A public proof-of-concept is available via WPScan, though EPSS remains very low at 0.15% (5th percentile) and SSVC reports no confirmed active exploitation.
Reflected Cross-Site Scripting in the Ultimate WooCommerce Auction Pro WordPress plugin (all versions through 2.4.5) allows remote attackers to inject arbitrary JavaScript into a page by tricking a logged-in high-privilege user, such as an administrator, into clicking a crafted link. The flaw stems from an unsanitized, unescaped request parameter reflected back into the response, and publicly available exploit code exists (reported by WPScan), though EPSS probability is low (0.15%, 4th percentile) and there is no evidence of active exploitation.
Reflected Cross-Site Scripting in Ultimate WooCommerce Auction Pro (≤2.4.5) enables unauthenticated remote attackers to inject arbitrary JavaScript into the browsers of high-privilege WordPress users, including administrators, by delivering a crafted URL containing an unsanitized parameter. Scope changes (S:C in CVSS) mean the injected script executes in the victim's browser session context, enabling session hijacking, credential theft, or unauthorized administrative actions. A public proof-of-concept is available via WPScan, though EPSS remains very low at 0.15% (5th percentile) and SSVC reports no confirmed active exploitation.