What is the CVSS score of CVE-2025-49074?

CVE-2025-49074 has a CVSS 3.1 base score of 6.5 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L. EPSS exploitation probability: 0.0%.

Which versions of WidgetKit are affected by CVE-2025-49074?

CVE-2025-49074 presents notable security risk, a cross-site scripting vulnerability rated CVSS 6.5. Attackers could inject scripts to steal sessions or perform actions as authenticated users.

How to fix or mitigate CVE-2025-49074?

Within 30 days: Identify affected systems and apply vendor patches as part of regular patch cycle. Verify Content-Security-Policy and output encoding.

WidgetKit CVE-2025-49074

EUVD-2025-17134 MEDIUM

Cross-site Scripting (XSS) (CWE-79)

2025-06-06 audit@patchstack.com

WordPress XSS Wordpress Plugin

6.5

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

6.5 MEDIUM

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L

vuln.today AI

6.5 MEDIUM

AV:N, AC:L, PR:L, UI:R, S:C, C:L/I:L/A:L

3.1 AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L

4.0 AV:N/AC:L/AT:N/PR:L/UI:R/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N

Primary rating from NVD.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

Required

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

Low

Lifecycle Timeline

EUVD ID Assigned

Mar 14, 2026 - 18:10 euvd

EUVD-2025-17134

Analysis Generated

Mar 14, 2026 - 18:10 vuln.today

CVE Published

Jun 06, 2025 - 12:15 nvd

MEDIUM 6.5

DescriptionCVE.org

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ThemesGrove WidgetKit allows Stored XSS.This issue affects WidgetKit: from n/a through 2.5.4.

AnalysisAI

Stored cross-site scripting in WidgetKit for Elementor allows authenticated attackers with contributor-level access to inject malicious scripts via widget settings. The vulnerability affects all versions up to 2.5.4 and can lead to session hijacking or defacement when an admin views the compromised page. No public exploit or active exploitation has been identified.

Technical ContextAI

WidgetKit is a WordPress plugin that extends Elementor page builder with additional widgets. The vulnerability is a stored XSS (CWE-79) where user-supplied input is not properly neutralized during web page generation. An attacker with contributor privileges can inject JavaScript that executes in the context of any user viewing the affected page, including administrators. The CVSS vector indicates low privileges required, user interaction needed (victim must visit the page), and scope change (impact on other components).

RemediationAI

Update WidgetKit to version 2.5.5 or later, which contains the fix. The vendor advisory from Patchstack confirms the patched version. As a workaround, restrict contributor-level accounts to trusted users only, or use a web application firewall (WAF) to filter XSS payloads. Note that disabling the plugin may break Elementor widget functionality.