This vulnerability in the wphocus My auctions allegro plugin allows an attacker to exploit CSRF to inject stored XSS payloads. The affected versions include all up to and including 3.6.33. The CVSS 3.1 score is 7.1, indicating a high severity with network attack vector, low attack complexity, no privileges required, user interaction required, and impacts on confidentiality, integrity, and availability. No known exploits in the wild or patches have been reported.

Successful exploitation could allow an attacker to execute stored XSS attacks via CSRF, potentially leading to unauthorized actions performed on behalf of authenticated users, compromising confidentiality, integrity, and availability of the affected system.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a patch or official fix is available, users should consider disabling or restricting use of the affected plugin to mitigate risk.