CVE-2025-49298
BaseFortify
Publication date: 2025-06-06
Last updated on: 2026-04-23
Assigner: Patchstack
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-79 | The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability is a Stored Cross-Site Scripting (XSS) issue in the WordPress Event post plugin up to version 5.10.1. It allows a malicious user with contributor-level privileges to inject malicious scripts, such as redirects or advertisements, into the website. These scripts execute when visitors access the affected pages, potentially compromising user interactions or site integrity. [1]
How can this vulnerability impact me? :
The vulnerability can lead to malicious scripts running on your website when visitors access affected pages. This can result in unwanted redirects, display of unauthorized advertisements, or other harmful HTML payloads. It may degrade user trust, harm your site's reputation, and potentially lead to further security issues. Although considered low severity, it still poses a risk to site security and user experience. [1]
How can this vulnerability be detected on my network or system? Can you suggest some commands?
This vulnerability can be detected by checking if the WordPress Event post plugin version is 5.10.1 or earlier, as these versions are vulnerable. There are no specific network detection commands provided. To detect the plugin version, you can use WordPress CLI commands such as `wp plugin list` to check the installed version of the Event post plugin. Additionally, reviewing posts created by contributor-level users for suspicious scripts or unexpected HTML payloads may help identify exploitation attempts. [1]
What immediate steps should I take to mitigate this vulnerability?
The immediate step to mitigate this vulnerability is to update the WordPress Event post plugin to version 5.10.2 or later, where the vulnerability is fixed. Alternatively, Patchstack offers virtual patching (vPatching) to auto-mitigate the vulnerability before applying the official patch. It is recommended to apply these updates promptly to reduce risk. [1]