CVE-2025-49443 describes a stored cross-site scripting vulnerability in the Bacon Ipsum project (versions up to 2.4). The issue is caused by improper neutralization of input during web page generation, which can lead to malicious script injection that persists and executes in users' browsers. The vulnerability has a CVSS 3.1 score of 6.5, reflecting medium severity with impacts on confidentiality, integrity, and availability. There is no vendor advisory or patch information available, and no known exploitation in the wild. The product is not cloud-hosted, so remediation depends on vendor or user patching.

Successful exploitation of this vulnerability could allow an attacker to execute arbitrary scripts in the context of the affected web application, potentially leading to partial compromise of confidentiality, integrity, and availability of the application and its users' data. The medium CVSS score reflects that exploitation requires low privileges and user interaction but can have a significant impact.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no patch or official fix information is provided, users should monitor for vendor updates and consider applying input validation or output encoding workarounds to mitigate stored XSS risks in the meantime.