CVE-2025-67557

The WP eBay Product Feeds plugin for WordPress (ebay-feeds-for-wordpress) versions through 3.4.9 suffer from a stored cross-site scripting (XSS) vulnerability due to improper neutralization of user input during web page generation [1]. This allows attackers with appropriate privileges to inject arbitrary scripts that are stored and executed later.

Exploitation requires a privileged user to perform an action, such as clicking a malicious link or submitting a crafted form, making user interaction necessary [1]. The injected script then executes when any visitor accesses the affected page.

Successful exploitation could allow attackers to inject malicious scripts, leading to redirects, advertisements, or other HTML payloads, potentially compromising site visitors [1]. This vulnerability is noted to be used in mass-exploit campaigns targeting thousands of websites.

The vendor has addressed the issue in version 3.4.10; users should update immediately or enable auto-updates [1]. The vulnerability has a CVSS score of 5.9 (Medium) and is assessed as low severity [1].