Cyber Resilience

CVE-2025-30522

High

Published: 24 March 2025

Published
24 March 2025
Modified
23 April 2026
KEV Added
Patch
CVSS Score v3.1 7.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L
EPSS Score 0.0016 36.7th percentile
Risk Priority 14 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2025-30522 is a high-severity CSRF (CWE-352) vulnerability. Its CVSS base score is 7.1 (High).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 36.7th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

The strongest mitigations our analysis identified are NIST 800-53 SC-23 (Session Authenticity) and SI-10 (Information Input Validation).

Deeper analysis

CVE-2025-30522 is a Cross-Site Request Forgery (CSRF) vulnerability in the Damian Orzol Contact Form 7 Material Design WordPress plugin (cf7-material-design) that allows Stored XSS. The issue affects the plugin from unknown initial versions through version 1.0.0.

Attackers with network access can exploit this vulnerability without authentication privileges, though it requires low complexity and user interaction. Per the CVSS 3.1 score of 7.1 (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L), exploitation changes the scope and enables limited impacts on confidentiality, integrity, and availability through stored XSS payloads injected via forged requests.

Patchstack has documented the vulnerability in its database, detailing the CSRF-to-Stored XSS issue in Contact Form 7 Material Design version 1.0.0. Security practitioners should consult the advisory at the provided reference for mitigation recommendations.

EU & UK References

Vulnerability details

Cross-Site Request Forgery (CSRF) vulnerability in Damian Orzol Contact Form 7 Material Design cf7-material-design allows Stored XSS.This issue affects Contact Form 7 Material Design: from n/a through <= 1.0.0.

CWE(s)

Related Threats

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
T1059.007 JavaScript Execution
Adversaries may abuse various implementations of JavaScript for execution.
Why these techniques?

CSRF-to-stored XSS in public-facing WordPress plugin directly enables T1190 exploitation of public-facing apps; stored XSS payload facilitates arbitrary JavaScript execution in victim browsers via T1059.007.

Confidence: HIGH · MITRE ATT&CK Enterprise v19.0

CVEs Like This One

CVE-2025-28931Shared CWE-352
CVE-2025-23980Shared CWE-352
CVE-2025-23710Shared CWE-352
CVE-2025-23822Shared CWE-352
CVE-2025-25128Shared CWE-352
CVE-2025-31616Shared CWE-352
CVE-2025-23483Shared CWE-352
CVE-2025-23817Shared CWE-352
CVE-2025-23446Shared CWE-352
CVE-2025-23664Shared CWE-352

Affected Assets

Mitigating Controls

Mitigating Controls (NIST 800-53 r5) AI

prevent

SI-2 requires timely identification, reporting, and correction of flaws like this CSRF-to-Stored XSS vulnerability in the plugin, directly eliminating the issue via patching.

prevent

SC-23 enforces session authenticity mechanisms such as anti-CSRF tokens, preventing forged requests from injecting stored XSS payloads.

prevent

SI-10 mandates validation of inputs to contact forms, blocking malicious XSS payloads from being stored via the CSRF vector.

References