CVE-2025-62881
MediumCVSS 4.3Exploitation Probability (EPSS)
Low risk13th percentile - higher than 13% of all known CVEs
Summary
The WP-Lister Lite for eBay (wp-lister-for-ebay) plugin has a missing authorization vulnerability, allowing exploitation of incorrectly configured access control security levels. This issue affects versions up to and including 3.8.3.
Risk Assessment
The risk is the possibility of unauthorized access to administrative functions of the plugin, which could lead to unauthorized changes or data leakage.
Recommendation
It is recommended to update the WP-Lister Lite for eBay plugin to the latest version that includes the fix for the missing authorization.
Other vulnerabilities in WP-Lister Lite for eBay
See all- CVE-2026-66628High
The WP-Lister Lite for eBay plugin in versions up to and including 3.8.11 contains a Shop manager SQL Injection vulnerability. This allows a shop manager-level user to inject malicious SQL code into database queries.
- CVE-2026-18595High
The WP-Lister Lite for eBay plugin for WordPress in all versions up to and including 3.8.9 is vulnerable to Stored Cross-Site Scripting via the AJAX Cron Handler Request Parameter due to insufficient input sanitization and output escaping. This allows unauthenticated attackers to inject arbitrary web scripts into pages that will execute whenever a user accesses an injected page.
- CVE-2026-11973Medium
The WP-Lister Lite for eBay plugin for WordPress is vulnerable to generic SQL Injection via the 'orderby' parameter in all versions up to and including 3.8.8. This is due to insufficient escaping and lack of preparation on the SQL query. Authenticated attackers with shop manager-level access or above can append additional SQL queries to extract sensitive information from the database.
Original NVD description (English source)
Missing Authorization vulnerability in WP Lab WP-Lister Lite for eBay wp-lister-for-ebay allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP-Lister Lite for eBay: from n/a through <= 3.8.3.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS