CVE-2025-50037: 
WordPress vulnerability analysis and mitigation

A DOM-Based Cross-Site Scripting (XSS) vulnerability was discovered in the Buying Buddy IDX CRM WordPress plugin, identified as CVE-2025-50037. The vulnerability affects all versions of the plugin up to and including version 2.3.0. The issue was identified on June 19, 2025, and publicly disclosed on June 20, 2025 (Patchstack).

The vulnerability is classified as a DOM-Based Cross-Site Scripting (XSS) issue with a CVSS v3.1 base score of 6.5 (Medium). The vulnerability requires low attack complexity and limited privileges, with user interaction required for exploitation. The attack vector is network-based, and the scope is changed, with low impact on confidentiality, integrity, and availability (Patchstack).

If successfully exploited, this vulnerability could allow a malicious actor with Contributor-level access to inject malicious scripts into the website. These scripts could be used to create redirects, insert unwanted advertisements, or execute other HTML payloads that would affect visitors to the affected site (Patchstack).

As of the vulnerability disclosure, no official fix has been made available for this security issue. Given the low severity impact, virtual patching has been deemed unnecessary (Patchstack).