PT-2025-38960 · Unknown · Morganrichards Auction Feed

Published 2025-09-22 · Updated 2025-09-23 · CVE-2025-58671

Positive Technologies (AI Summary)

CVSS v3.1

7.1

High

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L

Name of the Vulnerable Software and Affected Versions morganrichards Auction Feed versions through 1.1.3

Description The software contains a flaw related to improper input handling during web page generation, which allows for Stored Cross-site Scripting (XSS). This means that malicious scripts can be injected into the web application and executed by other users. The vulnerability allows for the injection of malicious code through the application.

Recommendations Update morganrichards Auction Feed to a version later than 1.1.3.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2025-58671

Affected Products

Morganrichards Auction Feed

References · 4

• https://nvd.nist.gov/vuln/detail/CVE-2025-58671 · Security Note
• https://twitter.com/CVEnew/status/1970621860267335885 · Twitter Post
• https://patchstack.com/database/Wordpress/Plugin/auction-feed/vulnerability/wordpress-auction-feed-plugin-1-1-3-cross-site-request-forgery-csrf-vulnerability?_s_id=cve · Note
• https://patchstack.com/database/wordpress/plugin/auction-feed/vulnerability/wordpress-auction-feed-plugin-1-1-3-cross-site-request-forgery-csrf-vulnerability?_s_id=cve · Note