Ebay Feeds For Wordpress Vulnerabilities

The eBay Product Feeds plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 3.4.9 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level access and above, to inject arbitrary web scripts in p...

CVSS:

4.4

Affected:

up to 3.4.9

Fixed in:

3.4.10

Disclosed:

Dec 15, 2025

CVE-2025-67557 on NVD →

[en] Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Rhys Wynne WP eBay Product Feeds ebay-feeds-for-wordpress allows Stored XSS.This issue affects WP eBay Product Feeds: from n/a through <= 3.4.9.

Affected:

up to 3.4.9

Fix:

No patched version reported

Disclosed:

Dec 9, 2025

CVE-2025-67557 on NVD →

The WP eBay Product Feeds plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 3.4.8. This makes it possible for authenticated attackers, with Contributor-level access and above, to make web requests to arbitrary locations originating from the web application which can...

CVSS:

6.4

Affected:

up to 3.4.8

Fixed in:

3.4.9

Disclosed:

Sep 9, 2025

CVE-2025-58977 on NVD →

[en] Server-Side Request Forgery (SSRF) vulnerability in Rhys Wynne WP eBay Product Feeds allows Server Side Request Forgery. This issue affects WP eBay Product Feeds: from n/a through 3.4.8.

Affected:

up to 3.4.9

Fixed in:

3.4.9

Disclosed:

Sep 9, 2025

CVE-2025-58977 on NVD →

[en] Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Winwar Media WP eBay Product Feeds plugin <= 3.3.1 versions.

Affected:

up to 3.4

Fixed in:

3.4

Disclosed:

Mar 23, 2023

CVE-2023-23722 on NVD →

The WP eBay Product Feeds plugin for WordPress is vulnerable to Stored Cross-Site Scripting via its settings parameters in versions up to, and including, 3.3.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions and above,...

CVSS:

5.5

Affected:

up to 3.3.1

Fixed in:

3.4

Disclosed:

Jan 19, 2023

CVE-2023-23722 on NVD →

The WP eBay Product Feeds plugin for WordPress is vulnerable to Stored Cross-Site Scripting via its settings parameters in versions up to, and including, 3.3.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions and above,...

Affected:

up to 3.4

Fixed in:

3.4

Disclosed:

Jan 19, 2023

[en] Cross-site scripting (XSS) vulnerability in magpie/scripts/magpie_slashbox.php in the Ebay Feeds for WordPress plugin 1.1 and earlier for WordPress allows remote attackers to inject arbitrary web script or HTML via the rss_url parameter.

Affected:

up to 1.2

Fixed in:

1.2

Disclosed:

Dec 27, 2019

CVE-2014-4525 on NVD →

Cross-site scripting (XSS) vulnerability in magpie/scripts/magpie_slashbox.php in the Ebay Feeds for WordPress plugin 1.0 and earlier for WordPress allows remote attackers to inject arbitrary web script or HTML via the rss_url parameter.

CVSS:

6.1

Affected:

up to 1.1

Fixed in:

1.1

Disclosed:

Apr 25, 2014

CVE-2014-4525 on NVD →