CVE-2026-22491
Published: 25 March 2026
Summary
CVE-2026-22491 is a high-severity Cross-site Scripting (CWE-79) vulnerability. Its CVSS base score is 7.1 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 14.4th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-15 (Information Output Filtering).
Deeper analysis
CVE-2026-22491 is an Improper Neutralization of Input During Web Page Generation vulnerability, classified as Reflected Cross-site Scripting (XSS) under CWE-79, affecting the WordPress plugin "My Auctions Allegro" (also known as my-auctions-allegro-free-edition) developed by wphocus. The issue impacts all versions from n/a through 3.6.35, with a CVSS v3.1 base score of 7.1 (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L).
A remote, unauthenticated attacker can exploit this vulnerability over the network with low complexity by crafting malicious input that is reflected back in a web page. Exploitation requires user interaction, such as clicking a malicious link, which triggers the execution of arbitrary JavaScript in the victim's browser context. This results in a scope change, enabling limited impacts to confidentiality, integrity, and availability.
The Patchstack advisory at https://patchstack.com/database/Wordpress/Plugin/my-auctions-allegro-free-edition/vulnerability/wordpress-my-auctions-allegro-plugin-3-6-33-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve provides further details on this vulnerability, including specifics for affected plugin versions like 3.6.33.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-15493
Vulnerability details
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in wphocus My auctions allegro my-auctions-allegro-free-edition allows Reflected XSS.This issue affects My auctions allegro: from n/a through <= 3.6.35.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Reflected XSS in public-facing WordPress plugin directly enables exploitation of the web application (T1190) to achieve arbitrary JavaScript execution in the victim browser (T1059.007) via a malicious link requiring user interaction (T1204.001).
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Information Output Filtering directly prevents reflected XSS by filtering malicious input reflected during web page generation before sending to the browser.
Information Input Validation comprehensively addresses improper neutralization of input by enforcing validation at the application layer to block crafted malicious payloads.
Flaw Remediation requires timely patching of the vulnerable WordPress plugin versions up to 3.6.35 to eliminate the XSS vulnerability.