{"id":"CVE-2026-4110","aliases":["EUVD-2026-38211","GHSA-gxfr-4w92-cm52"],"status":"published","title":"Ultimate WooCommerce Auction Pro \u003c= 2.4.5 - Reflected XSS via uwa_auctions_bids_list","description":"The ultimate-woocommerce-auction-pro WordPress plugin through 2.4.5 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin","severity":{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium","assessor":"adp","from":"cve"},"epss":{"day":"2026-11-10","score":0.00253,"percentile":0.16905,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"published":"2026-06-22T06:00:01Z","modified":"2026-06-22T18:38:02Z","products":[{"vendor":"unknown","product":"ultimate-woocommerce-auction-pro"}],"references":[{"url":"https://wpscan.com/vulnerability/bd44396a-7723-4876-a9c6-266442879bcb/","tags":["exploit","vdb-entry","technical-description"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-4110"},{"url":"https://wpscan.com/vulnerability/bd44396a-7723-4876-a9c6-266442879bcb"},{"url":"https://github.com/advisories/GHSA-gxfr-4w92-cm52"}],"sources":{"cve":[{"id":"CVE-2026-4110","title":"Ultimate WooCommerce Auction Pro \u003c= 2.4.5 - Reflected XSS via uwa_auctions_bids_list","description":"The ultimate-woocommerce-auction-pro WordPress plugin through 2.4.5 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin","status":"published","published":"2026-06-22T06:00:01.721Z","modified":"2026-06-22T16:34:10.426Z","cvss":[{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium","assessor":"adp"}],"updated_at":"2026-11-02T14:19:58.944663Z"}],"euvd":[{"id":"EUVD-2026-38211","description":"The ultimate-woocommerce-auction-pro WordPress plugin through 2.4.5 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin","status":"published","published":"2026-06-22T06:00:01Z","modified":"2026-06-22T16:34:10Z","cvss":[{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T18:20:34.238696Z"}],"ghsa":[{"id":"GHSA-gxfr-4w92-cm52","title":"The ultimate-woocommerce-auction-pro WordPress plugin through 2.4.5 does not sanitise and escape...","description":"The ultimate-woocommerce-auction-pro WordPress plugin through 2.4.5 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin","status":"published","published":"2026-06-22T09:30:45Z","modified":"2026-06-22T18:35:15Z","cvss":[{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T15:08:56.309175Z"}],"nvd":[{"id":"CVE-2026-4110","description":"The ultimate-woocommerce-auction-pro WordPress plugin through 2.4.5 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin","status":"published","published":"2026-06-22T06:16:16.79Z","modified":"2026-06-22T18:38:02.507Z","cvss":[{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium","assessor":"secondary"}],"updated_at":"2026-11-02T14:12:24.912854Z"}]}}