Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
2 selected

2 records

Vendor: WP Marka Component: Wordpress Auction Clear all filters
TI-2024-08223 CVE-2024-8857 · GHSA-f8c3-q6gm-6v3x

WordPress Auction <= 3.7 - Editor+ Stored XSS

Priority MEDIUM 55

The WordPress Auction Plugin WordPress plugin through 3.7 does not sanitise and escape some of its settings, which could allow high privilege users such as editors to perform Stored Cross-Site Scripting attacks.

CVSS 3.1MEDIUM 4.8 Network High privileges User interaction EPSS 0.00332 Published 2025-01-07 No fix listed CWE-79
TI-2024-08221 CVE-2024-8855 · GHSA-qrfp-c3c5-pw2c

WordPress Auction <= 3.7 - Editor+ SQL Injection

Priority HIGH 82

The WordPress Auction Plugin WordPress plugin through 3.7 does not sanitize and escape a parameter before using it in a SQL statement, allowing editors and above to perform SQL injection attacks

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00647 Published 2025-01-07 No fix listed CWE-89