What is the CVSS score of CVE-2025-49939?

CVE-2025-49939 has a CVSS 3.1 base score of 6.5 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L. EPSS exploitation probability: 0.1%.

PHP CVE-2025-49939

MEDIUM

Cross-site Scripting (XSS) (CWE-79)

2025-10-22 audit@patchstack.com

WordPress PHP XSS

6.5

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

6.5 MEDIUM

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

Required

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

Low

Lifecycle Timeline

Analysis Generated

Apr 01, 2026 - 15:22 vuln.today

CVE Published

Oct 22, 2025 - 15:15 nvd

MEDIUM 6.5

DescriptionCVE.org

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Crocoblock JetElements For Elementor jet-elements allows Stored XSS.This issue affects JetElements For Elementor: from n/a through <= 2.7.8.

AnalysisAI

Stored cross-site scripting (XSS) in Crocoblock JetElements For Elementor plugin through version 2.7.8 allows authenticated users with low privileges to inject malicious scripts that execute in the browsers of site visitors, potentially compromising site integrity and user sessions. The vulnerability requires user interaction (UI:R) and affects authenticated users (PR:L), limiting immediate blast radius but posing persistent risk to WordPress installations using this Elementor extension.

Technical ContextAI

JetElements For Elementor is a WordPress plugin that extends the Elementor page builder with additional widgets and functionality. The vulnerability stems from improper input neutralization during web page generation (CWE-79), a classic stored XSS flaw where user-supplied input is not adequately sanitized or escaped before being rendered in HTML context. Because the vulnerability is stored rather than reflected, malicious payloads persist in the database and execute whenever affected pages are viewed. The attack surface involves the plugin's widget configuration or content handling mechanisms that accept user input without proper validation or output encoding.

Affected ProductsAI

Crocoblock JetElements For Elementor plugin version 2.7.8 and earlier are vulnerable. The plugin is distributed as a WordPress plugin available through Patchstack's vulnerability database. Users can identify their installation version through the WordPress plugin management interface (Plugins > Installed Plugins > JetElements For Elementor). The plugin is typically installed on WordPress sites running compatible versions of the Elementor page builder.

RemediationAI

Update JetElements For Elementor to a patched version released after 2.7.8 as provided by Crocoblock. Check the official Patchstack vulnerability entry (https://patchstack.com/database/Wordpress/Plugin/jet-elements/vulnerability/wordpress-jetelements-for-elementor-plugin-2-7-8-cross-site-scripting-xss-vulnerability?_s_id=cve) for the exact patched version number and installation instructions. In WordPress, navigate to Plugins > Installed Plugins, locate JetElements For Elementor, and click Update when available. If a patched version is not yet available, restrict plugin access to trusted administrators only and audit recent content modifications for signs of XSS payload injection. Test the site thoroughly after patching to ensure page builder functionality is not disrupted.