CVE-2026-42635: WordPress WooCommerce Simple Auctions plugin <= 3.0.10 - Cross Site Scripting (XSS) vulnerability
Unauthenticated Cross Site Scripting (XSS) in WooCommerce Simple Auctions <= 3.0.10 versions.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
The vulnerability is unauthenticated, so an attacker does not need a WordPress account or plugin-level privileges to attempt exploitation. Exploitation does require user interaction, as reflected by the UI:R vector.
Which installations are affected?
WooCommerce Simple Auctions versions 3.0.10 and earlier are identified as affected. The provided data does not state whether a particular plugin configuration or feature must be enabled.
What is the potential impact?
Successful XSS exploitation may affect confidentiality, integrity, and availability at low impact levels. The CVSS vector also indicates the impact can extend beyond the vulnerable component's security authority (S:C).
How can I determine whether we are affected?
Check whether WordPress has the WooCommerce Simple Auctions plugin installed and identify its installed version. Instances running version 3.0.10 or earlier should be treated as affected based on the available information.