{"id":"CVE-2026-61988","kind":"vulnerability","aliases":["CVE-2026-61988"],"related":[],"title":"Auction Nudge WordPress plugin: unauthenticated XSS through versions 8.4.0","description":"Unauthenticated Cross Site Scripting (XSS) in Auction Nudge – Your eBay on Your Site <= 8.4.0 versions.","summary":"The Auction Nudge – Your eBay on Your Site WordPress plugin, versions up to and including 8.4.0, has an unauthenticated cross-site scripting flaw. An attacker can inject script that runs in a visitor's browser.","severity":"high","cvss":7.1,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["auction-nudge","ebay-plugin","package","wordpress"],"not_affected_if":["plugin-not-installed"],"how_to_check":"- Check the installed version of Auction Nudge – Your eBay on Your Site in the WordPress admin under Plugins.","fix":"- Move to a version later than `8.4.0`; the sources do not name the exact fixed version.","status":"open","published_at":"2026-10-29T16:18:11+00:00","first_seen_at":"2026-10-29T16:25:59+00:00","triaged_at":"2026-10-29T16:29:57+00:00","updated_at":"2026-10-29T16:29:57+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-10-29T16:29:57Z","model":"claude-haiku-5-5","output":{"fix":"- Move to a version later than `8.4.0`; the sources do not name the exact fixed version.","reach":"internet","title":"Auction Nudge WordPress plugin: unauthenticated XSS through versions 8.4.0","impact":"medium","summary":"The Auction Nudge – Your eBay on Your Site WordPress plugin, versions up to and including 8.4.0, has an unauthenticated cross-site scripting flaw. An attacker can inject script that runs in a visitor's browser.","audience":"businesses","category":"package","nicknames":[],"who_cares":["wordpress","auction-nudge","ebay-plugin"],"confidence":0.6,"fix_status":"unknown","needs_auth":"no","worst_case":"Attacker script runs in visitors' browsers on the site","analyst_note":"Confirm the first fixed plugin version and whether the XSS is reflected or stored, via the NVD entry https://nvd.nist.gov/vuln/detail/CVE-2026-61988 and the plugin's changelog.","how_to_check":"- Check the installed version of Auction Nudge – Your eBay on Your Site in the WordPress admin under Plugins.\n- unknown for other checks; the sources do not say.","plain_action":"","needs_analyst":true,"not_affected_if":["plugin-not-installed"],"who_is_affected":"Sites running the Auction Nudge – Your eBay on Your Site WordPress plugin at version 8.4.0 or earlier are exposed. The flaw needs no login, so any site visitor can reach it. Sites without this plugin can skip it.","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000703,"input_tokens":4090,"output_tokens":588,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-2026':11A,14A '-61988':12A,15A '8.4.0':9A,39B,73C 'attack':49B 'auction':1A,17B,25B,66C 'auction-nudg':16B 'browser':59B 'cross':44B,61C 'cross-sit':43B 'cve':10A,13A 'ebay':20B,28B,69C 'ebay-plugin':19B 'flaw':47B 'includ':38B 'inject':51B 'nudg':2A,18B,26B,67C 'packag':22B 'plugin':4A,21B,33B 'run':54B 'script':46B,52B,63C 'site':31B,45B,62C,72C 'unauthent':5A,42B,60C 'version':8A,34B,74C 'visitor':57B 'wordpress':3A,23B,32B 'xss':6A,64C","nicknames":[],"mitigations":[],"who_affected":"Sites running the Auction Nudge – Your eBay on Your Site WordPress plugin at version 8.4.0 or earlier are exposed. The flaw needs no login, so any site visitor can reach it. Sites without this plugin can skip it.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"unknown","audience":"businesses","plain_action":null,"first_public_at":"2026-10-29T16:18:11+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L","cvss_by":"audit@patchstack.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-61988","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-61988","severity":null,"published_at":"2026-10-29T16:18:11+00:00","modified_at":"2026-10-29T16:20:19+00:00","first_seen_at":"2026-10-29T16:25:59+00:00","fetched_at":"2026-10-29T16:25:59+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}