What is the CVSS score of CVE-2025-49934?

CVE-2025-49934 has a CVSS 3.1 base score of 6.5 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L. EPSS exploitation probability: 0.1%.

Wordpress Plugin CVE-2025-49934

MEDIUM

Cross-site Scripting (XSS) (CWE-79)

2025-10-22 audit@patchstack.com

WordPress XSS Wordpress Plugin

6.5

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

6.5 MEDIUM

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

Required

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

Low

Lifecycle Timeline

CVSS changed

Apr 23, 2026 - 15:42 NVD

5.4 (MEDIUM) 6.5 (MEDIUM)

Analysis Generated

Apr 01, 2026 - 15:22 vuln.today

CVE Published

Oct 22, 2025 - 15:15 nvd

MEDIUM 5.4

DescriptionCVE.org

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Crocoblock JetBlocks For Elementor jet-blocks allows Stored XSS.This issue affects JetBlocks For Elementor: from n/a through <= 1.3.18.

AnalysisAI

Stored cross-site scripting (XSS) in Crocoblock JetBlocks For Elementor plugin versions up to 1.3.18 allows authenticated users with low privileges to inject malicious scripts that execute in the browsers of other site visitors. The vulnerability requires user interaction (UI:R) and affects confidentiality and integrity, with an EPSS score of 0.06% indicating very low real-world exploitation likelihood despite the moderate CVSS 5.4 rating.

Technical ContextAI

This is a CWE-79 input validation failure in a WordPress Elementor plugin, where user-supplied data is rendered into web pages without proper HTML entity encoding or content security policy. The Elementor page builder ecosystem integrates dynamically generated content from plugin components (JetBlocks), and the improper neutralization occurs during the rendering phase where user input is converted to page output. The vulnerability is classified as stored XSS rather than reflected, meaning the malicious payload persists in the database and affects multiple users across page views, making it more serious than reflected variants. CPE coverage would typically be WP_PLUGIN_CROCOBLOCK_JETBLOCKS.

Affected ProductsAI

Crocoblock JetBlocks For Elementor plugin for WordPress is affected in versions from initial release through version 1.3.18. The vulnerability exists across all installations of this Elementor page builder extension at or below the 1.3.18 release. More information is available in the Patchstack vulnerability database at https://patchstack.com/database/Wordpress/Plugin/jet-blocks/vulnerability/wordpress-jetblocks-for-elementor-plugin-1-3-18-cross-site-scripting-xss-vulnerability?_s_id=cve.

RemediationAI

Update the JetBlocks For Elementor plugin to the first version released after 1.3.18. WordPress administrators should navigate to the Plugins section, locate JetBlocks For Elementor, and apply the available update immediately. The Patchstack advisory (referenced above) should be consulted for the exact patched version number and any additional configuration recommendations from Crocoblock. Until patching is possible, administrators should restrict the user roles capable of editing Elementor pages and JetBlocks content to trusted personnel only, reducing the likelihood of lower-privilege account compromise.