What is the CVSS score of CVE-2025-49443?

CVE-2025-49443 has a CVSS 3.1 base score of 6.5 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L. EPSS exploitation probability: 0.0%.

Which versions of Bacon Ipsum are affected by CVE-2025-49443?

CVE-2025-49443 presents notable security risk, a cross-site scripting vulnerability rated CVSS 6.5. Attackers could inject scripts to steal sessions or perform actions as authenticated users.

How to fix or mitigate CVE-2025-49443?

Within 30 days: Identify affected systems and apply vendor patches as part of regular patch cycle. Verify Content-Security-Policy and output encoding.

Bacon Ipsum CVE-2025-49443

EUVD-2025-17148 MEDIUM

Cross-site Scripting (XSS) (CWE-79)

2025-06-06 audit@patchstack.com

WordPress XSS Wordpress Plugin

6.5

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

6.5 MEDIUM

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L

vuln.today AI

6.5 MEDIUM

PR:L due to contributor access; UI:R required; scope changed.

3.1 AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L

4.0 AV:N/AC:L/AT:N/PR:L/UI:R/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N

Primary rating from NVD.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

Required

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

Low

Lifecycle Timeline

EUVD ID Assigned

Mar 14, 2026 - 18:10 euvd

EUVD-2025-17148

Analysis Generated

Mar 14, 2026 - 18:10 vuln.today

CVE Published

Jun 06, 2025 - 13:15 nvd

MEDIUM 6.5

DescriptionCVE.org

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Chris McCoy Bacon Ipsum allows Stored XSS. This issue affects Bacon Ipsum: from n/a through 2.4.

AnalysisAI

Stored cross-site scripting in Bacon Ipsum WordPress plugin through version 2.4 allows authenticated attackers with contributor-level access or higher to inject malicious scripts into web pages. These scripts execute when other users view affected content, potentially leading to session hijacking or defacement. No public exploit or active exploitation has been identified.

Technical ContextAI

The vulnerability is a stored cross-site scripting (XSS) flaw in the Bacon Ipsum WordPress plugin, which generates placeholder text. The plugin fails to properly sanitize user-supplied input before storing it, allowing JavaScript injection. The CWE-79 classification indicates improper neutralization of input during web page generation. The affected product is a WordPress plugin, and the CPE likely points to the plugin slug 'bacon-ipsum'.

RemediationAI

Upgrade Bacon Ipsum plugin to version 2.5 or later, which contains the fix. No workaround is available; disabling the plugin may break functionality that relies on placeholder text generation. The vendor advisory provides no alternative mitigations.