CVE-2025-24658: 
WordPress vulnerability analysis and mitigation

A Stored Cross-Site Scripting (XSS) vulnerability was identified in the WordPress plugin 'Auction Nudge – Your eBay on Your Site' affecting versions up to 7.2.0. The vulnerability was discovered by researcher b4orvn and was publicly disclosed on January 24, 2025 (Patchstack).

The vulnerability is classified as CWE-79 (Improper Neutralization of Input During Web Page Generation) and has received a CVSS v3.1 base score of 5.9 (Medium) with the vector string CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:L. The issue requires administrator privileges to exploit and involves improper input neutralization during web page generation (NVD, Patchstack).

If exploited, this vulnerability could allow malicious actors to inject malicious scripts, including redirects, advertisements, and other HTML payloads into the website. These injected scripts would be executed when guests visit the affected site (Patchstack).

The vulnerability requires administrator-level privileges to exploit, which significantly reduces its potential impact. It has been classified as having a low severity impact and is considered unlikely to be exploited (Patchstack).

The vulnerability has been fixed in version 7.2.1 of the plugin. Users are advised to update to version 7.2.1 or later to remove the vulnerability. Patchstack users have the option to enable auto-update for vulnerable plugins (Patchstack).