Executive brief
WP-Lister Lite for eBay is a popular WordPress plugin used to manage and synchronize product listings with eBay. An unauthenticated attacker can inject malicious scripts into the plugin that persist in the database and execute in the browsers of any user who visits an affected page, potentially leading to account compromise, data theft, or malware distribution.
Technical details
The WP-Lister Lite for eBay plugin suffers from a stored cross-site scripting (XSS) vulnerability in versions up to 3.8.9. The vulnerability exists in the AJAX cron handler request parameter processing, where user input is not properly sanitized before being stored in the database and not escaped when output to the page. An unauthenticated attacker can craft a malicious request to inject arbitrary JavaScript code that will be stored persistently and executed in the context of any user's browser when they access an injected page. No authentication is required to exploit this vulnerability. Patches are available in versions after 3.8.9.
Affected products
- Automattic WP-Lister Lite for eBay up to 3.8.9
Timeline
- 2026-09-16: disclosed: CVE-2026-18595 published