CVE-2026-18595 is a stored cross-site scripting vulnerability in the WP-Lister Lite for eBay WordPress plugin. The flaw exists in all versions up to and including 3.8.9 due to improper neutralization of input in an AJAX Cron Handler request parameter. This allows unauthenticated attackers to inject arbitrary web scripts that execute in the context of users visiting the injected page, potentially leading to session hijacking or other script-based attacks.

An unauthenticated attacker can exploit this vulnerability to inject malicious scripts that execute in the browsers of users who visit the affected pages. This can lead to information disclosure, session hijacking, or other client-side attacks. The CVSS score of 7.2 (high) reflects the network attack vector, low attack complexity, no privileges required, no user interaction needed, and impact on confidentiality and integrity with no impact on availability.

No official patch or fix information is provided in the available data. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, users should consider disabling the affected plugin or restricting access to the AJAX Cron Handler endpoint if possible.