What is the CVSS score of CVE-2025-49923?

CVE-2025-49923 has a CVSS 3.1 base score of 5.9 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:L. EPSS exploitation probability: 0.0%.

Seriously Simple Podcasting CVE-2025-49923

MEDIUM

Cross-site Scripting (XSS) (CWE-79)

2025-10-22 audit@patchstack.com

WordPress XSS Seriously Simple Podcasting Wordpress Plugin Castos

5.9

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

5.9 MEDIUM

AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:L

vuln.today AI

4.8 MEDIUM

PR:H required to introduce the payload; UI:R for victim page visit; S:C reflects cross-browser XSS execution; A:N as DOM XSS does not independently cause availability impact.

3.1 AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:H/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N

Primary rating from NVD.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

Required

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

Low

Lifecycle Timeline

Analysis Generated

Jul 25, 2026 - 12:20 vuln.today

CVE Published

Oct 22, 2025 - 15:15 cve.org

MEDIUM 5.9

DescriptionCVE.org

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Craig Hewitt Seriously Simple Podcasting seriously-simple-podcasting allows DOM-Based XSS.This issue affects Seriously Simple Podcasting: from n/a through <= 3.11.1.

AnalysisAI

DOM-based XSS in the Seriously Simple Podcasting WordPress plugin (versions through 3.11.1) enables a high-privileged attacker to inject malicious client-side scripts that execute in the browsers of visitors who subsequently view the affected podcast content. The CVSS vector (PR:H, UI:R) confirms this requires both admin-level WordPress access to introduce the payload and a victim's page interaction to trigger execution. With an EPSS of 0.02% (7th percentile), no CISA KEV listing, and no public exploit identified, real-world risk is low despite the network-accessible attack vector.

Technical ContextAI

Seriously Simple Podcasting is a WordPress podcast management plugin developed by Craig Hewitt and maintained by Castos (CPE: cpe:2.3:a:castos:seriously_simple_podcasting:*:*:*:*:*:wordpress:*:*). The root cause is CWE-79 (Improper Neutralization of Input During Web Page Generation), specifically the DOM-based variant. Unlike reflected or stored XSS where the server processes and echoes the payload, DOM-based XSS occurs entirely in the browser: client-side JavaScript reads attacker-controlled data from the DOM (e.g., from URL fragments, query parameters, or unsanitized plugin-stored values) and writes it to the page without proper encoding. This means server-side output escaping is insufficient - the sanitization gap is in the JavaScript rendering layer. The vulnerability affects all versions of the plugin from its initial release through 3.11.1 on WordPress.

RemediationAI

Update the Seriously Simple Podcasting plugin to the first version released after 3.11.1; the exact patched version number is not confirmed in the current input data and should be verified via the Patchstack advisory at https://patchstack.com/database/Wordpress/Plugin/seriously-simple-podcasting/vulnerability/wordpress-seriously-simple-podcasting-plugin-3-11-1-cross-site-scripting-xss-vulnerability or the WordPress plugin repository changelog before deploying. As a compensating control while patching is pending, restrict WordPress administrator and editor roles exclusively to trusted personnel, since the PR:H requirement means limiting admin access directly eliminates the attack vector. Patchstack subscribers can apply a virtual firewall rule for temporary protection; note that generic WAF rules may be ineffective against DOM-based XSS because the payload is processed client-side and may not traverse the server. Reviewing and auditing existing podcast plugin fields for injected content after the patch is applied is also advisable.