CVE-2026-18595

WP-Lister Lite for eBay, a popular WordPress plugin for syncing WooCommerce/eBay listings, is vulnerable to stored cross-site scripting in all versions up to and including 3.8.9 via an AJAX cron handler request parameter, due to insufficient input sanitization and output escaping. Because the flaw is exploitable without authentication, any remote attacker can submit crafted input that is stored and rendered as arbitrary JavaScript, executing in the browser of any user who views an injected page. Successful exploitation lets the attacker steal session cookies, impersonate or act as victims (including administrators), deface content, or redirect users to malicious sites. Any WordPress site running WP-Lister Lite for eBay at or below version 3.8.9 is affected. There is currently no known public proof of concept, no CISA KEV listing, and no evidence of exploitation in the wild.

What to do: Update WP-Lister Lite for eBay immediately to a version later than 3.8.9 (the latest available release). Because this is unauthenticated stored XSS, administrators should also audit posts, pages, and plugin-generated content for injected JavaScript, and review user accounts and admin sessions for signs of takeover. If immediate patching is not possible, use a WAF or server rules to scrutinize unauthenticated requests to the plugin's AJAX cron handler endpoints and monitor logs for abuse.