CVE-2025-24658 describes a stored cross-site scripting vulnerability in the Joe Auction Nudge – Your eBay on Your Site plugin, versions up to 7.2.0. The issue is due to improper input neutralization during web page generation, which allows attackers with high privileges to inject malicious scripts that execute when other users view the affected pages. The vulnerability has a CVSS 3.1 base score of 5.9, reflecting medium severity with network attack vector, low attack complexity, required privileges, and user interaction. The impact includes limited confidentiality, integrity, and availability loss. No patch or official remediation guidance is currently documented.

Successful exploitation could allow an attacker with high privileges to inject stored malicious scripts that execute in the context of other users' browsers, potentially leading to limited disclosure of information, modification of content, or disruption of service. The overall impact is rated medium due to the required privileges and user interaction, and the limited scope of confidentiality, integrity, and availability impacts. No known active exploitation has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should restrict high privilege access to trusted personnel and consider disabling or limiting use of the affected plugin. Monitor vendor channels for updates and apply patches promptly once released.