CVE-2025-58671 is a stored cross-site scripting vulnerability in the morganrichards Auction Feed product (versions up to 1.1.4). The issue arises from improper neutralization of input during web page generation, allowing malicious script injection that persists and executes when users access the affected content. The vulnerability has a CVSS 3.1 score of 7.1, reflecting a network attack vector with low complexity and requiring user interaction. There is no vendor advisory or patch information available at this time, and no known exploitation has been reported.

Successful exploitation of this vulnerability could allow attackers to execute arbitrary scripts in the context of users viewing the auction feed, potentially leading to information disclosure, session hijacking, or other client-side impacts. The vulnerability affects confidentiality, integrity, and availability to a limited extent as indicated by the CVSS vector. No known active exploitation has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider applying input validation or output encoding workarounds if feasible. Monitor official morganrichards communications for updates and patches addressing this vulnerability.