What is the CVSS score of CVE-2025-49927?

CVE-2025-49927 has a CVSS 3.1 base score of 6.5 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L. EPSS exploitation probability: 0.1%.

PHP CVE-2025-49927

MEDIUM

Cross-site Scripting (XSS) (CWE-79)

2025-10-22 audit@patchstack.com

WordPress PHP XSS

6.5

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

6.5 MEDIUM

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

Required

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

Low

Lifecycle Timeline

Analysis Generated

Apr 01, 2026 - 15:22 vuln.today

CVE Published

Oct 22, 2025 - 15:15 nvd

MEDIUM 6.5

DescriptionCVE.org

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Crocoblock JetWooBuilder jet-woo-builder allows Stored XSS.This issue affects JetWooBuilder: from n/a through <= 2.1.20.1.

AnalysisAI

Stored XSS vulnerability in Crocoblock JetWooBuilder WordPress plugin versions up to 2.1.20.1 allows authenticated users with low privileges to inject malicious scripts that execute in the browsers of other users viewing affected pages, potentially leading to session hijacking, credential theft, or defacement. The vulnerability requires user interaction (UI:R) from victims and affects the confidentiality, integrity, and availability of website content. No public exploit code or active exploitation has been confirmed at time of analysis.

Technical ContextAI

This is a Stored (Persistent) XSS vulnerability classified under CWE-79 (Improper Neutralization of Input During Web Page Generation), indicating that the JetWooBuilder plugin fails to properly sanitize or escape user-supplied input before storing it in a database and later rendering it in web pages. The plugin, which integrates WooCommerce functionality with WordPress page builders, likely accepts user input through form fields, product settings, or builder components without adequate input validation or output encoding. When authenticated users with low privileges (PR:L per CVSS vector) submit crafted input, the malicious script is stored and subsequently executed in the browser context of other users viewing the affected pages, escalating the impact from a single attacker to all site visitors with appropriate access levels.

Affected ProductsAI

Crocoblock JetWooBuilder WordPress plugin versions from the beginning through 2.1.20.1 are affected. The plugin is distributed via the WordPress.org plugin repository and is identified by the CPE context for WordPress plugins (wp-plugin-jetwooobuilder). Users running any version up to and including 2.1.20.1 should take remediation action.

RemediationAI

Update the Crocoblock JetWooBuilder plugin to the latest patched version released by the vendor after 2.1.20.1. Visit the official WordPress plugin repository page for JetWooBuilder or check directly in the WordPress admin dashboard (Plugins → Updates) for an available update. For immediate interim protection, WordPress site administrators should review and restrict user roles with editing capabilities to trusted individuals only, and consider temporarily disabling the plugin on production sites if a patch is not immediately available. The vulnerability was reported by audit@patchstack.com and details are available at the Patchstack vulnerability database entry listed in references.