CVE-2025-27009highCWE-352

CVE-2025-27009: falha de alta gravidade em wphocus My auctions allegro

WordPress My auctions allegro plugin <= 3.6.33 - Cross Site Request Forgery (CSRF) vulnerability

Publicada em · Atualizada em

Seguir esta CVE+ Monitorar My auctions allegro

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

21Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackcvss 7.1epss 0.1%
Cross-Site Request Forgery (CSRF) vulnerability in wphocus My auctions allegro my-auctions-allegro-free-edition allows Stored XSS.This issue affects My auctions allegro: from n/a through <= 3.6.33.
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L
Produtos afetados
wphocus · My auctions allegro
CVEs relacionadas — wphocus My auctions allegro

No mesmo produto, das mais perigosas para as menos.

CVE-2025-12851HIGHMy auctions allegro <= 3.6.32 - Unauthenticated Local File Inclusion via controllerEPSS 0.8%CVE-2026-22464HIGHWordPress My auctions allegro plugin <= 3.6.33 - Local File Inclusion vulnerabilityEPSS 0.5%CVE-2024-11707MEDIUMMy auctions allegro <= 3.6.17 - Reflected Cross-Site ScriptingEPSS 0.4%CVE-2025-12850HIGHMy auctions allegro <= 3.6.32 - Unauthenticated SQL Injection via auction_idEPSS 0.3%CVE-2025-31542HIGHWordPress My auctions allegro plugin <= 3.6.20 - SQL Injection vulnerabilityEPSS 0.3%CVE-2025-10048MEDIUMMy Auctions Allegro Plugin <= 3.6.31 - Authenticated (Admin+) SQL InjectionEPSS 0.3%