CVE-2025-49944CWE-79cross-site-scripting

CVE-2025-49944

High · published October 22, 2025

CVSS v3.1
7.1
EPSS
0%
Percentile
21.1
In the wild
Unconfirmed
What it is

⚡ A classic case of Cross-site Scripting (XSS) lurks in WPCode Content Ratio, allowing attackers to inject harmful scripts! 🦸‍♂️ Think of it like a restaurant that serves food without checking the ingredients first. If someone sneaks in a nasty allergen unnoticed, it could lead to a serious reaction for unsuspecting diners! This vulnerability means an attacker could potentially execute malicious scripts in the browsers of users visiting affected sites. This could lead to data theft, session hijacking, or even a complete takeover of user accounts. Yikes! 🔥

Put simply

Think of it like a restaurant that serves food without checking the ingredients first. If someone sneaks in a nasty allergen unnoticed, it could lead to a serious reaction for unsuspecting diners! The vulnerability arises from improper handling of user input during the web page generation process, allowing for reflected XSS attacks. Attackers can exploit this flaw to inject arbitrary scripts into web pages that are viewed by other users.

What to do

This vulnerability means an attacker could potentially execute malicious scripts in the browsers of users visiting affected sites. This could lead to data theft, session hijacking, or even a complete takeover of user accounts. Yikes! 🔥 To remediate this vulnerability, update WPCode Content Ratio to the latest version immediately. Ensure that input validation and output escaping are properly implemented to mitigate these risks. Regular audits and security reviews are also recommended! 🛡️ You've got this! With these steps, you'll enhance your defenses and keep your users safe! 💪😊

The record
Technical detail
CVSS v3.1
7.1 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L
CVSS v4.0
Not supplied
EPSS
0.00296 · 21.1th percentile
Weakness
CWE-79 · Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Published
2025-10-22T19:15Z
References (1)
EPSS history
Timeline
  • 22 OCT 14:32Z
    WordPress WPCode Content Ratio plugin <= 2.0 - Cross Site Scripting (XSS) vulnerability
    cvelistv5