What is the CVSS score of CVE-2025-49933?

CVE-2025-49933 has a CVSS 3.1 base score of 6.5 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L. EPSS exploitation probability: 0.1%.

PHP CVE-2025-49933

MEDIUM

Cross-site Scripting (XSS) (CWE-79)

2025-10-22 audit@patchstack.com

WordPress PHP XSS

6.5

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

6.5 MEDIUM

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

Required

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

Low

Lifecycle Timeline

Analysis Generated

Apr 01, 2026 - 15:22 vuln.today

CVE Published

Oct 22, 2025 - 15:15 nvd

MEDIUM 6.5

DescriptionCVE.org

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Crocoblock JetBlog jet-blog allows Reflected XSS.This issue affects JetBlog: from n/a through <= 2.4.4.

AnalysisAI

Reflected cross-site scripting (XSS) in Crocoblock JetBlog WordPress plugin through version 2.4.4 allows authenticated users to inject malicious scripts that execute in other users' browsers when they interact with crafted links. The vulnerability requires user interaction (UI:R) and authenticated access (PR:L), limiting but not eliminating real-world risk; EPSS score of 0.07% indicates low exploitation probability despite the moderate CVSS 6.5 rating.

Technical ContextAI

JetBlog is a WordPress plugin for dynamic blog content generation. The vulnerability stems from improper input sanitization during web page generation (CWE-79: Improper Neutralization of Input During Web Page Generation). The plugin fails to adequately escape or validate user-supplied parameters before rendering them in HTML output, allowing an authenticated attacker to inject arbitrary JavaScript code. When a victim visits a malicious link crafted by the attacker, the unfiltered input executes in the victim's browser under the context of the vulnerable page, potentially accessing session data or performing actions on behalf of the victim.

Affected ProductsAI

Crocoblock JetBlog WordPress plugin versions from an unspecified baseline through and including version 2.4.4 are affected. The plugin is distributed via the official WordPress plugin repository and is identified by the slug 'jet-blog'. Users running version 2.4.4 or earlier should prioritize upgrading to the next available patched release.

RemediationAI

Update Crocoblock JetBlog to the patched version released after 2.4.4 as specified in the Patchstack security advisory (https://patchstack.com/database/Wordpress/Plugin/jet-blog/vulnerability/wordpress-jetblog-plugin-2-4-4-cross-site-scripting-xss-vulnerability?_s_id=cve). The patch addresses input neutralization by implementing proper output escaping during web page generation. Administrators should verify plugin updates are available through the WordPress admin dashboard or the Patchstack plugin repository. As a temporary workaround pending patch availability, restrict plugin access to trusted administrator accounts only and monitor for suspicious parameter values in server logs.