CVE-2025-49956CWE-79cross-site-scripting

CVE-2025-49956

High · published October 22, 2025

CVSS v3.1
7.1
EPSS
0%
Percentile
15.4
In the wild
Unconfirmed
What it is

⚡ Watch out! Your Fade Slider could easily be tricked into displaying malicious content, thanks to a sneaky Cross-site Scripting (XSS) vulnerability! 🔥 This is like a restaurant allowing customers to order off the menu without ever double-checking their requests — one wrong order could upset the entire dining experience! An attacker could insert harmful scripts into the web page, potentially stealing sensitive user information or hijacking user sessions — absolutely devastating for both users and the site's integrity!

Put simply

This is like a restaurant allowing customers to order off the menu without ever double-checking their requests — one wrong order could upset the entire dining experience! This reflected XSS vulnerability in Fade Slider allows attackers to inject scripts into responses, exploiting the lack of proper input sanitization during page generation.

What to do

An attacker could insert harmful scripts into the web page, potentially stealing sensitive user information or hijacking user sessions — absolutely devastating for both users and the site's integrity! Update your Fade Slider to version 2.5.1 or later to patch this vulnerability. Also, consider implementing Content Security Policies (CSP) to help mitigate potential XSS attacks. You've got this! By taking these steps, you're one step closer to securing your site! 🛡️

The record
Technical detail
CVSS v3.1
7.1 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L
CVSS v4.0
Not supplied
EPSS
0.00250 · 15.4th percentile
Weakness
CWE-79 · Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Published
2025-10-22T19:15Z
References (1)
EPSS history
Timeline
  • 22 OCT 14:32Z
    WordPress Fade Slider plugin <= 2.5 - Cross Site Scripting (XSS) vulnerability
    cvelistv5