CVE-2025-49927

MediumCVSS 6.5

Published: 22/10/2025(UTC)Updated: 08/10/2026(UTC)Translated: 08/10/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.22%

12th percentile - higher than 12% of all known CVEs

Summary

Stored XSS vulnerability in JetWooBuilder up to version 2.1.20.1. An attacker can store a malicious script that executes when the page is viewed.

Risk Assessment

Potential for account takeover, data theft, or content modification.

Recommendation

Update the JetWooBuilder plugin to a patched version.

Other vulnerabilities in JetWooBuilder

CVE-2025-49928Medium
DOM-Based XSS vulnerability in JetWooBuilder up to version 2.1.20. An attacker can exploit it to execute a script in the victim's browser.

Original NVD description (English source)

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Crocoblock JetWooBuilder jet-woo-builder allows Stored XSS.This issue affects JetWooBuilder: from n/a through <= 2.1.20.1.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS