Security readout for executives and security teams
Plain-English summary
A flaw in the JetSearch plugin for WordPress (versions up to and including 3.5.10) lets an attacker craft a malicious link that, when clicked by a site visitor or admin, runs unauthorized scripts in their browser. This can hijack sessions, deface pages, or redirect users. Sites running JetSearch should review vendor guidance and update.
Executive priority
Patch on the next standard maintenance window for any externally facing WordPress site running JetSearch. Treat as high priority for sites where administrators routinely click links delivered via email or chat, since the scope-change rating means a successful lure could compromise admin accounts.
Technical view
Reflected Cross-Site Scripting (CWE-79) in Crocoblock's JetSearch (jet-search) plugin through 3.5.10, scored CVSS 7.1 (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L). User-supplied input is reflected into rendered output without proper neutralization. Scope change indicates the payload can affect resources beyond the vulnerable component, e.g., the broader WordPress admin context when an authenticated user is lured to a crafted URL.
Likely exposure
WordPress sites using the JetSearch plugin at version 3.5.10 or earlier with public-facing search functionality. Exposure is broad given JetSearch's adoption in the Crocoblock/Elementor ecosystem, but exploitation requires a victim to click an attacker-crafted link.
Exploitation context
No CISA KEV listing and no public reports of active exploitation in the cited sources. CVSS vector requires user interaction (UI:R) and no privileges (PR:N), so a successful attack hinges on social engineering a logged-in user, typically an administrator, to follow a malicious link.
Researcher notes
CVSS 7.1 with Scope:Changed and Confidentiality/Integrity/Availability all Low reflects a reflected XSS that can pivot beyond the plugin context. Affected-versions metadata in the bundle is incomplete (defaultStatus "unaffected" with version "0"); rely on the description's "n/a through <= 3.5.10" range. No fixed version is named in the supplied sources—verify via Patchstack and Crocoblock changelog before declaring remediation complete.
Mitigation direction
- Inventory WordPress sites for the JetSearch (jet-search) plugin and record installed versions.
- Consult Crocoblock and Patchstack advisories for a fixed release and apply the update.
- If no fix is available, restrict or disable the plugin on exposed sites until patched.
- Place the site behind a WAF with rules that block reflected XSS payloads in query parameters.
- Enforce a strict Content-Security-Policy to limit inline script execution.
- Train administrators to avoid clicking unsolicited search or admin URLs.
Validation and detection
- Query plugin inventory for jet-search and confirm version is greater than 3.5.10 after update.
- Review WAF and webserver logs for suspicious query strings targeting JetSearch endpoints.
- Test the patched site with a benign reflected-input check to confirm output encoding.
- Cross-reference Patchstack advisory for the fixed version and confirmed remediation.
- Audit admin sessions and audit logs for anomalous activity around the plugin's URLs.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-79: User-session and phishing behavior lookup
Client-side and session-facing weaknesses should be reviewed alongside initial-access and user-execution behaviors. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCVE-2025-49930 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- High
- CVSS
- 7.1 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L2.83.7Primary CVE scoreVulnerability scoring details
Base CVSS 3.1 score
7.1HighVector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L
Source materials
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.