Stored XSS Vulnerability in ovatheme BRW by OvaTheme
CVE-2025-49314

6.5MEDIUM

Key Information:

Vendor

WordPress
Status
Brw
Vendor
CVE Published:
6 June 2025

What is CVE-2025-49314?

The Stored XSS vulnerability in OvaTheme's BRW product allows attackers to inject malicious scripts into web pages. This can lead to significant security risks as user input is improperly neutralized during page generation, potentially compromising user data and web application integrity. The flaw affects all versions from n/a up to 1.8.6, making it essential for users to update their product to protect against possible exploitation.

Affected Version(s)

BRW <= 1.8.6

References

https://patchstack.com/database/wordpress/plugin/ova-brw/...
vdb-entry

CVSS V3.1

Score:
6.5
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Phat RiO - BlueRock (Patchstack Alliance)
.