What is the CVSS score of CVE-2025-49306?

CVE-2025-49306 has a CVSS 3.1 base score of 6.5 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L. EPSS exploitation probability: 0.0%.

Which versions of WP Social Widget are affected by CVE-2025-49306?

CVE-2025-49306 presents notable security risk, a cross-site scripting vulnerability rated CVSS 6.5. Attackers could inject scripts to steal sessions or perform actions as authenticated users.

How to fix or mitigate CVE-2025-49306?

Within 30 days: Identify affected systems and apply vendor patches as part of regular patch cycle. Verify Content-Security-Policy and output encoding.

WP Social Widget CVE-2025-49306

EUVD-2025-17262 MEDIUM

Cross-site Scripting (XSS) (CWE-79)

2025-06-06 audit@patchstack.com

WordPress XSS Wp Social Widget Wordpress Plugin Catchsquare

6.5

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

6.5 MEDIUM

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L

vuln.today AI

6.5 MEDIUM

PR:L due to contributor role; UI:R required; scope changed (S:C) as script executes in victim's session.

3.1 AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L

4.0 AV:N/AC:L/AT:N/PR:L/UI:A/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N

Primary rating from NVD.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

Required

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

Low

Lifecycle Timeline

Analysis Generated

Jul 26, 2026 - 13:32 vuln.today

CVSS changed

Apr 23, 2026 - 15:42 NVD

5.4 (MEDIUM) 6.5 (MEDIUM)

EUVD ID Assigned

Mar 14, 2026 - 18:10 euvd

EUVD-2025-17262

CVE Published

Jun 06, 2025 - 13:15 cve.org

MEDIUM 6.5

CVE Published

Jun 06, 2025 - 13:15 nvd

MEDIUM 5.4

DescriptionCVE.org

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in catchsquare WP Social Widget allows Stored XSS. This issue affects WP Social Widget: from n/a through 2.3.

AnalysisAI

Stored cross-site scripting (XSS) in WP Social Widget through version 2.3 allows authenticated attackers with contributor-level access or higher to inject arbitrary web scripts into pages. These scripts execute when other users view the affected page, potentially leading to session hijacking or defacement. No public exploit or active exploitation has been identified.

Technical ContextAI

The vulnerability is a stored XSS (CWE-79) in the WordPress plugin WP Social Widget, which displays social media links. The plugin fails to sanitize user-supplied input before storing it in the database and later rendering it in web pages. CPE data confirms all versions up to 2.3 are affected. The attack requires low privileges (contributor role) and user interaction (admin viewing the injected page).

RemediationAI

Upgrade WP Social Widget to version 2.4 or later, which contains the fix per the vendor advisory. No workaround is available; disabling the plugin or restricting contributor roles may reduce risk but are not complete mitigations. The advisory URL is https://patchstack.com/database/wordpress/plugin/wp-social-widget/vulnerability/wordpress-wp-social-widget-2-3-cross-site-scripting-xss-vulnerability?_s_id=cve