CVE-2025-27009: WordPress My auctions allegro plugin <= 3.6.33 - Cross Site Request Forgery (CSRF) vulnerability
Cross-Site Request Forgery (CSRF) vulnerability in wphocus My auctions allegro allows Stored XSS.This issue affects My auctions allegro: from n/a through 3.6.20.
Other sources
Cross-Site Request Forgery (CSRF) vulnerability in wphocus My auctions allegro my-auctions-allegro-free-edition allows Stored XSS.This issue affects My auctions allegro: from n/a through <= 3.6.33.
— MITRE
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-27009?
CVE-2025-27009 is categorized as a medium severity Cross-Site Request Forgery (CSRF) vulnerability.
How do I fix CVE-2025-27009?
To fix CVE-2025-27009, update the My Auctions Allegro plugin to version 3.6.21 or later.
What versions of My Auctions Allegro are affected by CVE-2025-27009?
CVE-2025-27009 affects all versions of My Auctions Allegro up to and including 3.6.20.
Can CVE-2025-27009 lead to Stored XSS?
Yes, CVE-2025-27009 allows for Stored Cross-Site Scripting (XSS) due to its CSRF nature.
Is CVE-2025-27009 still a risk if My Auctions Allegro is updated?
No, if My Auctions Allegro is updated to a secure version, CVE-2025-27009 will no longer pose a risk.