What is the CVSS score of CVE-2025-49305?

CVE-2025-49305 has a CVSS 3.1 base score of 6.5 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L. EPSS exploitation probability: 0.0%.

Which versions of Product Catalog Simple are affected by CVE-2025-49305?

CVE-2025-49305 presents notable security risk, a cross-site scripting vulnerability rated CVSS 6.5. Attackers could inject scripts to steal sessions or perform actions as authenticated users.

How to fix or mitigate CVE-2025-49305?

Within 30 days: Identify affected systems and apply vendor patches as part of regular patch cycle. Verify Content-Security-Policy and output encoding.

Product Catalog Simple CVE-2025-49305

EUVD-2025-17263 MEDIUM

Cross-site Scripting (XSS) (CWE-79)

2025-06-06 audit@patchstack.com

WordPress XSS Wordpress Plugin

6.5

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

6.5 MEDIUM

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L

vuln.today AI

6.5 MEDIUM

AV:N, AC:L, PR:L, UI:R, S:C, C:L/I:L/A:L per description and CVSS vector.

3.1 AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L

4.0 AV:N/AC:L/AT:N/PR:L/UI:R/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N

Primary rating from NVD.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

Required

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

Low

Lifecycle Timeline

EUVD ID Assigned

Mar 14, 2026 - 18:10 euvd

EUVD-2025-17263

Analysis Generated

Mar 14, 2026 - 18:10 vuln.today

CVE Published

Jun 06, 2025 - 13:15 nvd

MEDIUM 6.5

DescriptionCVE.org

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in impleCode Product Catalog Simple allows Stored XSS. This issue affects Product Catalog Simple: from n/a through 1.8.1.

AnalysisAI

Stored cross-site scripting in Product Catalog Simple WordPress plugin up to version 1.8.1 allows authenticated attackers with contributor-level access or higher to inject arbitrary web scripts into product catalog pages. These scripts execute when other users view the affected pages, potentially leading to session hijacking or defacement. No public exploit or active exploitation has been identified, and EPSS score is low (0.05%).

Technical ContextAI

The vulnerability is a stored cross-site scripting (XSS) issue in the Product Catalog Simple WordPress plugin, which is used to create and manage product catalogs. The plugin fails to properly sanitize user-supplied input before storing it in the database and later rendering it in web pages. This is a classic CWE-79 (Improper Neutralization of Input During Web Page Generation) flaw. The affected component is likely the product title, description, or custom fields that are saved and displayed without adequate escaping.

RemediationAI

Update Product Catalog Simple to version 1.8.2 or later, which contains the fix. The vendor advisory from Patchstack confirms the patch. As a workaround, restrict contributor-level access to trusted users only, and consider using a web application firewall (WAF) to filter XSS payloads. Note that limiting user roles may impact site functionality if multiple contributors are needed.