CVE-2025-58828

The vulnerability is a Stored Cross-Site Scripting (XSS) issue in the WordPress plugin 코드엠샵 소셜톡 (mshop-naver-talktalk) versions through 1.2.2. It stems from improper neutralization of input during web page generation, allowing attackers to inject arbitrary JavaScript code that is stored on the server and executed in the browsers of visitors [1].

Exploitation requires a privileged user (e.g., an administrator) to perform an action such as clicking a malicious link or submitting a crafted form. This vulnerability is often used in mass-exploit campaigns targeting thousands of websites [1]. Once injected, the malicious script runs whenever a visitor accesses the affected page.

An attacker can leverage this to redirect visitors to malicious sites, display unwanted advertisements, or inject other HTML payloads. This can compromise site integrity and user trust [1].

As a mitigation, it is strongly recommended to update the plugin to a patched version immediately. If updating is not possible, contact your hosting provider or web developer for assistance [1].