The vulnerability CVE-2025-58990 affects DevItems ShopLentor woolentor-addons plugin versions up to 3.2.0. It is a stored cross-site scripting issue caused by improper input neutralization during web page generation. This allows an attacker with low privileges to inject malicious scripts that are stored and later executed in the context of other users' browsers, potentially leading to limited confidentiality, integrity, and availability impacts. The CVSS 3.1 vector indicates network attack vector, low attack complexity, required privileges, user interaction, and scope change.

Successful exploitation of this vulnerability can lead to execution of arbitrary scripts in the context of affected users, potentially resulting in limited disclosure of information, modification of data, or disruption of service. The impact is rated medium with a CVSS score of 6.5. There are no known exploits in the wild as of the published date.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should exercise caution with user-generated content and consider applying temporary mitigations such as input validation or output encoding where possible. Monitor vendor channels for updates and apply patches promptly once available.