What is the CVSS score of CVE-2025-49928?

CVE-2025-49928 has a CVSS 3.1 base score of 6.5 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L. EPSS exploitation probability: 0.1%.

PHP CVE-2025-49928

MEDIUM

Cross-site Scripting (XSS) (CWE-79)

2025-10-22 audit@patchstack.com

WordPress PHP XSS

6.5

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

6.5 MEDIUM

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

Required

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

Low

Lifecycle Timeline

Analysis Generated

Apr 01, 2026 - 15:22 vuln.today

CVE Published

Oct 22, 2025 - 15:15 nvd

MEDIUM 6.5

DescriptionCVE.org

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Crocoblock JetWooBuilder jet-woo-builder allows DOM-Based XSS.This issue affects JetWooBuilder: from n/a through <= 2.1.20.

AnalysisAI

DOM-based cross-site scripting (XSS) in Crocoblock JetWooBuilder plugin through version 2.1.20 allows authenticated users with low privileges to inject malicious scripts that execute in other users' browsers when they interact with affected pages. The vulnerability requires user interaction (UI:R per CVSS) and affects the plugin's web page generation functions. No public exploit code or active exploitation has been confirmed, though the issue carries a moderate CVSS score of 6.5 and low EPSS probability (0.07%, 22nd percentile) suggesting limited real-world attack incentive despite the authentication requirement being relatively low-barrier for WordPress environments.

Technical ContextAI

JetWooBuilder is a WordPress plugin that extends WooCommerce functionality with page building capabilities. The vulnerability is classified as CWE-79 (Improper Neutralization of Input During Web Page Generation), which indicates the plugin fails to properly sanitize or escape user-supplied input before rendering it in HTML/DOM context. This is a DOM-based XSS variant, meaning the payload execution occurs client-side through JavaScript manipulation of the Document Object Model rather than server-side template injection. The affected versions through 2.1.20 do not implement adequate input validation or output encoding when processing data destined for dynamic page generation, allowing authenticated users (PR:L in CVSS vector) to craft payloads that bypass intended restrictions.

Affected ProductsAI

Crocoblock JetWooBuilder WordPress plugin in all versions from the initial release through 2.1.20 is affected. JetWooBuilder is distributed via the WordPress Plugin Directory and identified by slug jet-woo-builder. The plugin integrates with WooCommerce to provide advanced page building and product customization features, making it commonly installed on WordPress e-commerce sites. All installations running version 2.1.20 or earlier require remediation.

RemediationAI

Update JetWooBuilder to a patched version released after 2.1.20. Site administrators should navigate to WordPress Dashboard > Plugins > Installed Plugins, locate JetWooBuilder, and click 'Update' if a newer version is available. Crocoblock has addressed this vulnerability in subsequent releases; check the Patchstack vulnerability database entry (https://patchstack.com/database/Wordpress/Plugin/jet-woo-builder/vulnerability/wordpress-jetwoobuilder-plugin-2-1-20-cross-site-scripting-xss-vulnerability?_s_id=cve) for the specific fixed version and release notes. As an interim mitigation, restrict lower-privilege user roles (subscribers, customers, contributors) from accessing page builder functionality if not operationally necessary, and review user access permissions to reduce the pool of potential attackers.