What is the CVSS score of CVE-2025-49358?

CVE-2025-49358 has a CVSS 3.1 base score of 6.5 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L. EPSS exploitation probability: 0.0%.

Wordpress Plugin CVE-2025-49358

MEDIUM

Cross-site Scripting (XSS) (CWE-79)

2025-12-31 audit@patchstack.com

WordPress XSS Wordpress Plugin

6.5

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

6.5 MEDIUM

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

Required

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

Low

Lifecycle Timeline

CVSS changed

Apr 23, 2026 - 15:43 NVD

6.5 (MEDIUM)

Analysis Generated

Apr 01, 2026 - 17:44 vuln.today

CVE Published

Dec 31, 2025 - 12:16 nvd

N/A

DescriptionCVE.org

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Ruhul Amin Content Fetcher content-fetcher allows DOM-Based XSS.This issue affects Content Fetcher: from n/a through <= 1.1.

AnalysisAI

DOM-based cross-site scripting (XSS) vulnerability in Ruhul Amin Content Fetcher WordPress plugin versions 1.1 and earlier allows authenticated attackers to inject arbitrary JavaScript code into web pages, potentially compromising site integrity and user sessions. The vulnerability resides in improper input neutralization during web page generation, enabling malicious scripts to execute in the context of affected websites. EPSS exploitation probability is extremely low at 0.01% (3rd percentile), indicating minimal real-world attack likelihood despite the XSS vector.

Technical ContextAI

The vulnerability is a DOM-based cross-site scripting flaw (CWE-79) in the Ruhul Amin Content Fetcher WordPress plugin, which is a content aggregation/fetching utility. DOM-based XSS occurs when the plugin processes user-controlled input in the Document Object Model (DOM) without proper sanitization or encoding, allowing malicious scripts embedded in URLs or form parameters to be executed client-side. The affected component handles web page generation and content retrieval; improper neutralization of input during this process creates the attack surface. This type of vulnerability is distinct from stored or reflected XSS because the malicious payload is processed entirely in the browser's DOM, often leveraging JavaScript frameworks or jQuery selectors without context-aware output encoding.

Affected ProductsAI

Ruhul Amin Content Fetcher WordPress plugin versions 1.1 and earlier (all versions from initial release through 1.1). The plugin is distributed via the WordPress plugin repository and identified in the Patchstack database. Exact CPE string for WordPress plugins is typically wp:wordpress:content-fetcher, though version-specific CPE data is limited in the provided references.

RemediationAI

Update the Content Fetcher plugin to a patched version released after 1.1. Users should navigate to WordPress admin dashboard, go to Plugins, search for 'Content Fetcher,' and click 'Update' if a new version is available. If no update is available, temporarily disable the plugin until a security patch is released. Input validation and output encoding should be applied to all user-controllable content rendered in the DOM; plugin developers should implement WordPress sanitization functions (sanitize_text_field, wp_kses_post) for input and escaping functions (esc_attr, esc_html) for output. Consult the Patchstack advisory at https://patchstack.com/database/Wordpress/Plugin/content-fetcher/vulnerability/wordpress-content-fetcher-plugin-1-1-cross-site-scripting-xss-vulnerability for ongoing updates.