CVE-2025-30522
Published: 24 March 2025
Summary
CVE-2025-30522 is a high-severity CSRF (CWE-352) vulnerability. Its CVSS base score is 7.1 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 36.7th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SC-23 (Session Authenticity) and SI-10 (Information Input Validation).
Deeper analysis
CVE-2025-30522 is a Cross-Site Request Forgery (CSRF) vulnerability in the Damian Orzol Contact Form 7 Material Design WordPress plugin (cf7-material-design) that allows Stored XSS. The issue affects the plugin from unknown initial versions through version 1.0.0.
Attackers with network access can exploit this vulnerability without authentication privileges, though it requires low complexity and user interaction. Per the CVSS 3.1 score of 7.1 (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L), exploitation changes the scope and enables limited impacts on confidentiality, integrity, and availability through stored XSS payloads injected via forged requests.
Patchstack has documented the vulnerability in its database, detailing the CSRF-to-Stored XSS issue in Contact Form 7 Material Design version 1.0.0. Security practitioners should consult the advisory at the provided reference for mitigation recommendations.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-7990
Vulnerability details
Cross-Site Request Forgery (CSRF) vulnerability in Damian Orzol Contact Form 7 Material Design cf7-material-design allows Stored XSS.This issue affects Contact Form 7 Material Design: from n/a through <= 1.0.0.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
CSRF-to-stored XSS in public-facing WordPress plugin directly enables T1190 exploitation of public-facing apps; stored XSS payload facilitates arbitrary JavaScript execution in victim browsers via T1059.007.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
SI-2 requires timely identification, reporting, and correction of flaws like this CSRF-to-Stored XSS vulnerability in the plugin, directly eliminating the issue via patching.
SC-23 enforces session authenticity mechanisms such as anti-CSRF tokens, preventing forged requests from injecting stored XSS payloads.
SI-10 mandates validation of inputs to contact forms, blocking malicious XSS payloads from being stored via the CSRF vector.