CVE-2026-4110

Name of the Vulnerable Software and Affected Versions ultimate-woocommerce-auction-pro versions prior to 2.4.6

Description The ultimate-woocommerce-auction-pro WordPress plugin fails to sanitize and escape a parameter before outputting it on the page. This leads to Reflected Cross-Site Scripting (XSS), a flaw where malicious scripts are reflected off a web application to the user's browser, which could be exploited against high-privilege users such as administrators. The issue occurs via the uwa auctions bids list parameter.

Recommendations Update the plugin to a version later than 2.4.5. As a temporary workaround, restrict access to the uwa auctions bids list parameter to minimize the risk of exploitation.