Woocommerce Simple Auctions
Monthly
Reflected cross-site scripting in the WooCommerce Simple Auctions WordPress plugin (versions up to and including 3.0.10) allows an unauthenticated attacker to inject arbitrary JavaScript that executes in the browser of any user tricked into loading a crafted link or input, as reflected by the CVSS vector CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L (score 7.1). The mandatory user interaction (UI:R) is the primary limiting factor - the attacker must deliver a malicious URL to a victim - while the absence of authentication requirements (PR:N) means any internet-facing WordPress site with the plugin active is reachable. No public exploit code or confirmed active exploitation was identified at time of analysis, and no EPSS score was supplied; the highest-value abuse path would be luring an authenticated administrator to a crafted link to leverage their session privileges.
Reflected cross-site scripting in the WooCommerce Simple Auctions WordPress plugin (versions up to and including 3.0.10) allows an unauthenticated attacker to inject arbitrary JavaScript that executes in the browser of any user tricked into loading a crafted link or input, as reflected by the CVSS vector CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L (score 7.1). The mandatory user interaction (UI:R) is the primary limiting factor - the attacker must deliver a malicious URL to a victim - while the absence of authentication requirements (PR:N) means any internet-facing WordPress site with the plugin active is reachable. No public exploit code or confirmed active exploitation was identified at time of analysis, and no EPSS score was supplied; the highest-value abuse path would be luring an authenticated administrator to a crafted link to leverage their session privileges.