What is the CVSS score of CVE-2025-49878?

CVE-2025-49878 has a CVSS 3.1 base score of 6.5 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L. EPSS exploitation probability: 0.0%.

Which versions of WPAdverts are affected by CVE-2025-49878?

CVE-2025-49878 presents notable security risk, a cross-site scripting vulnerability rated CVSS 6.5. Attackers could inject scripts to steal sessions or perform actions as authenticated users.

How to fix or mitigate CVE-2025-49878?

Within 30 days: Identify affected systems and apply vendor patches as part of regular patch cycle. Verify Content-Security-Policy and output encoding.

WPAdverts CVE-2025-49878

EUVD-2025-19222 MEDIUM

Cross-site Scripting (XSS) (CWE-79)

2025-06-17 audit@patchstack.com

WordPress XSS Wordpress Plugin

6.5

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

6.5 MEDIUM

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L

vuln.today AI

6.5 MEDIUM

PR:L due to contributor access required; UI:R for user interaction; S:C for scope change.

3.1 AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L

4.0 AV:N/AC:L/AT:N/PR:L/UI:A/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N

Primary rating from NVD.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

Required

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

Low

Lifecycle Timeline

EUVD ID Assigned

Mar 14, 2026 - 22:15 euvd

EUVD-2025-19222

Analysis Generated

Mar 14, 2026 - 22:15 vuln.today

CVE Published

Jun 17, 2025 - 15:15 nvd

MEDIUM 6.5

DescriptionCVE.org

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Greg Winiarski WPAdverts allows DOM-Based XSS. This issue affects WPAdverts: from n/a through 2.2.4.

AnalysisAI

DOM-based cross-site scripting in WPAdverts plugin for WordPress allows authenticated attackers with contributor-level access or higher to inject malicious scripts via crafted input. The vulnerability affects versions up to 2.2.4 and requires user interaction to trigger. No public exploit or active exploitation has been identified at this time.

Technical ContextAI

The vulnerability is a DOM-based XSS (CWE-79) in the WPAdverts plugin, which is a WordPress plugin for classified ads. DOM-based XSS occurs when client-side JavaScript processes user input unsafely, modifying the DOM environment. The CVSS vector indicates a low-privilege (PR:L) attack with user interaction (UI:R) and scope change (S:C), meaning the injected script can affect resources beyond the vulnerable component. The affected product is identified via CPE as WPAdverts versions through 2.2.4.

RemediationAI

Upgrade WPAdverts to version 2.2.5 or later, which contains the fix. The vendor advisory from Patchstack confirms the patch. As a workaround, restrict contributor-level access to trusted users only, or disable the plugin if not essential. No other compensating controls are recommended due to the low risk.