wp-lab vulnerabilities

Products

• WP-Lister Lite for eBay 2

Latest wp-lab CVEs

Newest publication first

1. CVE-2026-18595 WP-Lister Lite for eBay <= 3.8.9 - Unauthenticated Stored Cross-Site Scripting via AJAX Cron Handler Request

   Published 2026-09-16

   High·CVSS 7.2 EPSS 0.32%

   The WP-Lister Lite for eBay plugin for WordPress is vulnerable to Stored Cross-Site Scripting via AJAX Cron Handler Request Parameter in all versions up to, and including, 3.8.9 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated...

2. CVE-2026-11973 WP-Lister Lite for eBay <= 3.8.8 - Authenticated (Shop Manager+) SQL Injection via 'orderby' Parameter

   Published 2026-07-29

   Medium·CVSS 4.9 EPSS 0.51%

   The WP-Lister Lite for eBay plugin for WordPress is vulnerable to generic SQL Injection via the 'orderby' parameter in all versions up to, and including, 3.8.8 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.