CVE-2025-49928

MediumCVSS 6.5

Published: 22/10/2025(UTC)Updated: 08/10/2026(UTC)Translated: 08/10/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.22%

12th percentile - higher than 12% of all known CVEs

Summary

DOM-Based XSS vulnerability in JetWooBuilder up to version 2.1.20. An attacker can exploit it to execute a script in the victim's browser.

Risk Assessment

Risk of data theft, session hijacking, or unauthorized actions in the user's context.

Recommendation

Update the JetWooBuilder plugin to a patched version.

Other vulnerabilities in JetWooBuilder

CVE-2025-49927Medium
Stored XSS vulnerability in JetWooBuilder up to version 2.1.20.1. An attacker can store a malicious script that executes when the page is viewed.

Original NVD description (English source)

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Crocoblock JetWooBuilder jet-woo-builder allows DOM-Based XSS.This issue affects JetWooBuilder: from n/a through <= 2.1.20.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS