Cross-Site Scripting Vulnerability in Bacon Ipsum by Chris McCoy
CVE-2025-49443

6.5MEDIUM

Key Information:

Vendor

WordPress
Status
Bacon Ipsum
Vendor
CVE Published:
6 June 2025

What is CVE-2025-49443?

A Cross-Site Scripting (XSS) vulnerability in the Bacon Ipsum tool by Chris McCoy allows for the execution of malicious scripts within web pages. This security flaw is present in versions up to 2.4, enabling attackers to inject harmful code that can be executed in the browsers of users interacting with affected instances.

Affected Version(s)

Bacon Ipsum <= 2.4

References

https://patchstack.com/database/wordpress/plugin/bacon-ip...
vdb-entry

CVSS V3.1

Score:
6.5
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Chu The Anh (Blue Rock) (Patchstack Alliance)
.
CVE-2025-49443 : Cross-Site Scripting Vulnerability in Bacon Ipsum by Chris McCoy