The morganrichards Auction Feed plugin is affected by a stored Cross-site Scripting vulnerability that could allow unauthenticated attackers to execute arbitrary scripts in a user's browser.

This vulnerability is caused by improper neutralization of user-supplied input during web page generation (CWE-79). The flaw allows unauthenticated attackers to store malicious scripts that execute when a victim views the affected page.

The CVSS score of 7.1 indicates a high-severity risk to web application integrity. Successful exploitation could lead to session hijacking, theft of sensitive user data, or unauthorized actions performed on behalf of authenticated administrators, resulting in significant reputational and operational damage.

Immediate Action: Since a specific patch version is currently unknown, administrators should monitor the vendor advisory for updates and disable the Auction Feed plugin if the functionality is not critical to business operations.

Proactive Monitoring: Review web server and application logs for suspicious script injections or anomalous HTTP requests targeting the plugin endpoint.

Compensating Controls: Deploy or update Web Application Firewall (WAF) rules to filter and block common XSS payloads, providing a virtual patch until an official vendor update is released.

Public Exploit Available: No (exploit_available: false).

Given the high CVSS score and the nature of stored XSS, the risk of credential theft or administrative account takeover is substantial. Organizations utilizing this plugin must prioritize the implementation of WAF protections and maintain a strict watch for vendor-provided security updates to fully remediate this vulnerability.