Wphocus

12 CVEs across 1 Wphocus products. Browse Wphocus vulnerabilities, severities, and proof-of-concept exploits.

Wphocus products with known CVEs

ProductCVEs
My Auctions Allegro12
Wphocus CVEs — newest first
CVESeverityScorePublishedSummary
CVE-2026-22491High7.12026-03-25Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in wphocus My auctions allegro my-auctions-allegro-free-edit…
CVE-2026-22464High7.52026-01-22Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in wphocus My auctions allegro my-auction…
CVE-2025-67943High7.12026-01-22Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in wphocus My auctions allegro my-auctions-allegro-free-edit…
CVE-2025-68567Medium5.42025-12-24Cross-Site Request Forgery (CSRF) vulnerability in wphocus My auctions allegro my-auctions-allegro-free-edition allows Cross Site Request Forgery.This issue af…
CVE-2025-68566Medium5.92025-12-24Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in wphocus My auctions allegro my-auctions-allegro-free-edit…
CVE-2025-12851High8.12025-12-05The My auctions allegro plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 3.6.32 via the 'controller' parameter…
CVE-2025-12850High7.52025-12-05The My auctions allegro plugin for WordPress is vulnerable to SQL Injection via the ‘auction_id’ parameter in all versions up to, and including, 3.6.32 due to…
CVE-2025-10048Medium4.92025-10-11The My auctions allegro plugin for WordPress is vulnerable to SQL Injection via the 'order' parameter in all versions up to, and including, 3.6.31 due to insuf…
CVE-2025-27009High7.12025-04-14Cross-Site Request Forgery (CSRF) vulnerability in wphocus My auctions allegro my-auctions-allegro-free-edition allows Stored XSS.This issue affects My auction…
CVE-2025-31542High8.52025-03-31Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in wphocus My auctions allegro my-auctions-allegro-free-edit…
CVE-2025-22733High7.12025-01-21Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in wphocus My auctions allegro my-auctions-allegro-free-edit…
CVE-2024-11707Medium6.12024-12-03The My auctions allegro plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'page' parameter in all versions up to, and including, 3.6…