CVE-2025-58702: MarketKing WooCommerce XSS Vulnerability

CVE-2025-58702 Overview

CVE-2025-58702 is a stored cross-site scripting (XSS) vulnerability in the WebWizards MarketKing plugin, a multivendor marketplace extension for WooCommerce on WordPress. The flaw stems from improper neutralization of user-supplied input during web page generation, tracked as [CWE-79]. Affected installations include all MarketKing releases up to and including version 2.0.92. An authenticated attacker with low privileges can inject persistent JavaScript payloads that execute in the browser of any user who views the compromised page. Because the scope is changed, injected scripts can affect components beyond the vulnerable plugin.

Critical Impact

Stored XSS in a multivendor marketplace plugin lets low-privileged sellers plant JavaScript that executes in shoppers' and administrators' sessions, enabling session theft, account takeover, and pivot into WordPress administration.

Affected Products

• WebWizards MarketKing – Multivendor Marketplace for WooCommerce
• All versions from initial release through 2.0.92
• WordPress sites running the MarketKing plugin with vendor onboarding enabled

Discovery Timeline

• 2025-09-22 - CVE-2025-58702 published to NVD
• 2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-58702

Vulnerability Analysis

The vulnerability is a stored cross-site scripting flaw in the MarketKing multivendor marketplace plugin for WooCommerce. Input fields exposed to authenticated users, likely including vendor profile or product-management inputs, accept HTML and script content without adequate sanitization or output encoding. The malicious payload is written to the WordPress database and rendered later within storefront or administrative views. Because the CVSS scope is changed, script execution reaches contexts beyond the vulnerable component, including sessions belonging to shoppers and site administrators. User interaction is required, meaning a victim must load the page hosting the injected content.

Root Cause

MarketKing fails to apply WordPress sanitization primitives such as sanitize_text_field(), wp_kses_post(), or context-appropriate escaping helpers like esc_html() and esc_attr() when handling vendor-controlled input. Raw markup is stored in the database and echoed into rendered pages, allowing <script> tags or event-handler attributes to execute in the browser.

Attack Vector

An attacker authenticates as a low-privileged marketplace vendor and submits a crafted payload through a MarketKing input surface such as a shop name, description, or product field. The payload persists in the database. When another user, including a store administrator, loads the page that renders the malicious value, the browser executes the attacker-controlled JavaScript in the site's origin. Consequences include session cookie exfiltration, forced administrative actions via CSRF-like requests, and injection of secondary malware or phishing content into the storefront.

No verified public proof-of-concept is available. Refer to the Patchstack Vulnerability Report for technical details.

Detection Methods for CVE-2025-58702

Indicators of Compromise

• Vendor or product records containing <script> tags, javascript: URIs, or DOM event handlers such as onerror= and onload=.
• Unexpected outbound requests from browser sessions loading MarketKing storefront or admin pages.
• New or modified WordPress administrator accounts created shortly after a vendor edit action.
• Injected <iframe> or remote script src references pointing to attacker-controlled domains in rendered pages.

Detection Strategies

• Scan the WordPress database tables used by MarketKing and WooCommerce for HTML markup, angle brackets, and JavaScript URI schemes in fields that should contain plain text.
• Enable WordPress audit logging to capture vendor profile updates, product metadata changes, and administrative actions initiated from unusual sessions.
• Deploy a web application firewall rule set that inspects POST bodies to MarketKing endpoints for XSS signatures and Content-Security-Policy violation reports.

Monitoring Recommendations

• Review Content-Security-Policy report-uri submissions for blocked inline script execution originating on marketplace pages.
• Monitor for admin session activity that follows a vendor content update within a short time window.
• Alert on creation of new privileged WordPress users, plugin installations, or theme edits following vendor interactions.

How to Mitigate CVE-2025-58702

Immediate Actions Required

• Upgrade MarketKing to a release later than 2.0.92 as soon as the vendor publishes a fixed version.
• Audit existing vendor and product records for stored HTML or script payloads and remove or sanitize them.
• Restrict vendor registration to trusted parties and require manual approval for new marketplace sellers.
• Rotate WordPress administrator credentials and invalidate active sessions if injection artifacts are identified.

Patch Information

At the time of publication, the Patchstack advisory confirms the vulnerability affects MarketKing through 2.0.92. Administrators should monitor the plugin's official channel for an updated release and apply it immediately once available.

Workarounds

• Deploy a web application firewall with an XSS rule set in front of the WordPress site and enable strict inspection of marketplace endpoints.
• Configure a restrictive Content-Security-Policy header that disallows inline scripts and limits script sources to trusted origins.
• Temporarily disable the MarketKing plugin or set vendor accounts to read-only mode until a patched version is installed.
• Remove unfiltered_html capability from any non-administrator role that MarketKing may extend.

# Example restrictive CSP header for WordPress via .htaccess
Header set Content-Security-Policy "default-src 'self'; script-src 'self'; object-src 'none'; base-uri 'self'; frame-ancestors 'self'"