What is the CVSS score of CVE-2025-49858?

CVE-2025-49858 has a CVSS 3.1 base score of 6.5 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L. EPSS exploitation probability: 0.0%.

Which versions of Arconix Shortcodes are affected by CVE-2025-49858?

CVE-2025-49858 presents notable security risk, a cross-site scripting vulnerability rated CVSS 6.5. Attackers could inject scripts to steal sessions or perform actions as authenticated users.

How to fix or mitigate CVE-2025-49858?

Within 30 days: Identify affected systems and apply vendor patches as part of regular patch cycle. Verify Content-Security-Policy and output encoding.

Arconix Shortcodes CVE-2025-49858

EUVD-2025-28319 MEDIUM

Cross-site Scripting (XSS) (CWE-79)

2025-06-17 audit@patchstack.com

WordPress XSS Wordpress Plugin

6.5

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

6.5 MEDIUM

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L

vuln.today AI

6.5 MEDIUM

Matches NVD vector; requires low privileges and user interaction.

3.1 AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L

4.0 AV:N/AC:L/AT:N/PR:L/UI:R/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N

Primary rating from NVD.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

Required

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

Low

Lifecycle Timeline

EUVD ID Assigned

Mar 14, 2026 - 22:15 euvd

EUVD-2025-28319

Analysis Generated

Mar 14, 2026 - 22:15 vuln.today

CVE Published

Jun 17, 2025 - 15:15 nvd

MEDIUM 6.5

DescriptionCVE.org

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in tychesoftwares Arconix Shortcodes allows Stored XSS. This issue affects Arconix Shortcodes: from n/a through 2.1.17.

AnalysisAI

Stored cross-site scripting in Arconix Shortcodes WordPress plugin up to version 2.1.17 allows authenticated attackers with contributor-level access or higher to inject arbitrary web scripts into pages. These scripts execute when other users view the affected content, potentially leading to session hijacking or defacement. No public exploit or active exploitation has been identified.

Technical ContextAI

The vulnerability is a stored cross-site scripting (XSS) flaw in the Arconix Shortcodes WordPress plugin, which provides shortcodes for formatting content. The plugin fails to properly sanitize user-supplied input before storing it in the database and later rendering it in web pages. This is a classic CWE-79 (Improper Neutralization of Input During Web Page Generation) issue. The affected product is identified via CPE as a WordPress plugin, and the vulnerability exists in all versions up to and including 2.1.17.

RemediationAI

Update the Arconix Shortcodes plugin to version 2.1.18 or later, which contains the fix. The vendor advisory is available at the Patchstack link. As a workaround, restrict the ability to use shortcodes to trusted users only, or disable the plugin if not essential. Note that disabling the plugin may break site functionality that relies on its shortcodes.