CVE-2026-18595
HighCVSS 7.2Exploitation Probability (EPSS)
Low risk17th percentile - higher than 17% of all known CVEs
Summary
The WP-Lister Lite for eBay plugin for WordPress in all versions up to and including 3.8.9 is vulnerable to Stored Cross-Site Scripting via the AJAX Cron Handler Request Parameter due to insufficient input sanitization and output escaping. This allows unauthenticated attackers to inject arbitrary web scripts into pages that will execute whenever a user accesses an injected page.
Risk Assessment
An attacker can inject malicious scripts that execute in users' browsers, leading to session theft, credential theft, or unauthorized actions. This may affect both administrators and site visitors.
Recommendation
Update the WP-Lister Lite for eBay plugin to a version later than 3.8.9 or disable it if no update is available. Consider implementing a Content Security Policy (CSP) header to mitigate XSS impact.
Other vulnerabilities in WP-Lister Lite for eBay
See all- CVE-2026-66628High
The WP-Lister Lite for eBay plugin in versions up to and including 3.8.11 contains a Shop manager SQL Injection vulnerability. This allows a shop manager-level user to inject malicious SQL code into database queries.
- CVE-2026-11973Medium
The WP-Lister Lite for eBay plugin for WordPress is vulnerable to generic SQL Injection via the 'orderby' parameter in all versions up to and including 3.8.8. This is due to insufficient escaping and lack of preparation on the SQL query. Authenticated attackers with shop manager-level access or above can append additional SQL queries to extract sensitive information from the database.
Original NVD description (English source)
The WP-Lister Lite for eBay plugin for WordPress is vulnerable to Stored Cross-Site Scripting via AJAX Cron Handler Request Parameter in all versions up to, and including, 3.8.9 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.