Skip to content
OpenAdvisories

Vendor

wphocus

13 known vulnerabilities.

Products

My auctions allegro 13
All Critical High Medium Low Exploited only Public exploit

8 results · Clear filters · Feed

  • High 7.1
    CVE-2026-22491

    WordPress My auctions allegro plugin <= 3.6.35 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in wphocus My auctions allegro my-auctions-allegro-free-edition allows Reflected XSS.This issue affects My auctions allegro: from n/a through <= 3.6.35.

    wphocus My auctions allegro
  • High 7.5
    CVE-2026-22464

    WordPress My auctions allegro plugin <= 3.6.33 - Local File Inclusion vulnerability

    Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in wphocus My auctions allegro my-auctions-allegro-free-edition allows PHP Local File Inclusion.This issue affects My auctions allegro: from …

    wphocus My auctions allegro
  • High 7.1
    CVE-2025-67943

    WordPress My auctions allegro plugin <= 3.6.32 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in wphocus My auctions allegro my-auctions-allegro-free-edition allows Reflected XSS.This issue affects My auctions allegro: from n/a through <= 3.6.32.

    wphocus My auctions allegro
  • High 8.1
    CVE-2025-12851

    My auctions allegro <= 3.6.32 - Unauthenticated Local File Inclusion via controller

    The My auctions allegro plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 3.6.32 via the 'controller' parameter. This makes it possible for unauthenticated attackers to include and execute arbitrary files on the …

    wphocus My auctions allegro Web / CMS
  • High 7.5
    CVE-2025-12850

    My auctions allegro <= 3.6.32 - Unauthenticated SQL Injection via auction_id

    The My auctions allegro plugin for WordPress is vulnerable to SQL Injection via the ‘auction_id’ parameter in all versions up to, and including, 3.6.32 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the exist…

    wphocus My auctions allegro Web / CMS
  • High 7.1
    CVE-2025-27009

    WordPress My auctions allegro plugin <= 3.6.33 - Cross Site Request Forgery (CSRF) vulnerability

    Cross-Site Request Forgery (CSRF) vulnerability in wphocus My auctions allegro my-auctions-allegro-free-edition allows Stored XSS.This issue affects My auctions allegro: from n/a through <= 3.6.33.

    wphocus My auctions allegro
  • High 8.5
    CVE-2025-31542

    WordPress My auctions allegro plugin <= 3.6.20 - SQL Injection vulnerability

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in wphocus My auctions allegro my-auctions-allegro-free-edition allows Blind SQL Injection.This issue affects My auctions allegro: from n/a through <= 3.6.20.

    wphocus My auctions allegro
  • High 7.1
    CVE-2025-22733

    WordPress My auctions allegro Plugin <= 3.6.18 - Reflected Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in wphocus My auctions allegro my-auctions-allegro-free-edition allows Reflected XSS.This issue affects My auctions allegro: from n/a through <= 3.6.18.

    wphocus My auctions allegro