CVE-2026-4259 — Ultimate WooCommerce Auction Pro <= 2.4.5 - Reflected XSS via uwa_manage_auctions

CVE-2026-4259

Ultimate WooCommerce Auction Pro <= 2.4.5 - Reflected XSS via uwa_manage_auctions PUBLISHED

Description (CNA)

The ultimate-woocommerce-auction-pro WordPress plugin through 2.4.5 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin

Affected (CNA)

Vendor / product	Versions
Unknown / ultimate-woocommerce-auction-pro	affected 0 through 2.4.5

CWE

No CWE identifiers supplied.

References

https://wpscan.com/vulnerability/a98d234b-11e8-4a07-8593-982d656a4fd3/

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.