The WP Marka WordPress Auction Plugin (wp-auctions) versions up to 3.7 contain a stored cross-site scripting vulnerability due to improper input neutralization during web page generation. This vulnerability allows an attacker with high privileges to inject malicious scripts that could be executed in the context of other users, potentially impacting confidentiality, integrity, and availability to a limited extent. The vulnerability requires user interaction and privileges to exploit. No patch or vendor advisory detailing remediation is currently available.

Successful exploitation of this stored XSS vulnerability could allow an attacker with high privileges to execute arbitrary scripts in the context of other users, potentially leading to limited confidentiality, integrity, and availability impacts. The attack requires user interaction and elevated privileges, which limits the scope of exploitation. No known active exploits have been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict high-privilege user access and avoid interacting with untrusted input in the plugin. Monitor vendor channels for updates and apply patches promptly once released.