CVE-2025-30560
Published: 24 March 2025
Summary
CVE-2025-30560 is a high-severity CSRF (CWE-352) vulnerability. Its CVSS base score is 7.1 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 25.7th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SC-23 (Session Authenticity) and SI-10 (Information Input Validation).
Deeper analysis
CVE-2025-30560 is a Cross-Site Request Forgery (CSRF) vulnerability in the Sana Ullah jQuery Dropdown Menu plugin (jquery-drop-down-menu-plugin) for WordPress that enables Stored Cross-Site Scripting (XSS). The issue affects all versions of the plugin from its initial release through version 3.0 inclusive, as documented under CWE-352.
Attackers can exploit this vulnerability without privileges over the network by tricking an authenticated WordPress user into submitting a malicious request, such as through a crafted webpage or link that the user interacts with. Successful exploitation stores an XSS payload on the site, which executes in the context of other users viewing affected pages, potentially leading to session hijacking, data theft, or further site compromise. The CVSS v3.1 base score of 7.1 (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L) reflects high severity due to network accessibility, low attack complexity, required user interaction, and scope change with low impacts on confidentiality, integrity, and availability.
The Patchstack advisory at https://patchstack.com/database/Wordpress/Plugin/jquery-drop-down-menu-plugin/vulnerability/wordpress-jquery-dropdown-menu-plugin-3-0-csrf-to-stored-xss-vulnerability?_s_id=cve provides details on this CSRF-to-Stored XSS vulnerability in the WordPress plugin version 3.0. Security practitioners should review this reference for mitigation guidance, including any available patches or workarounds.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-7974
Vulnerability details
Cross-Site Request Forgery (CSRF) vulnerability in Sana Ullah jQuery Dropdown Menu jquery-drop-down-menu-plugin allows Stored XSS.This issue affects jQuery Dropdown Menu: from n/a through <= 3.0.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Vulnerability in public-facing WordPress plugin directly enables network exploitation (T1190); stored XSS payload facilitates arbitrary JavaScript execution in victim browsers (T1059.007).
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
SI-2 requires timely identification, reporting, and correction of system flaws, directly mitigating this CVE by patching or removing the vulnerable jQuery Dropdown Menu plugin.
SI-10 enforces validation of information inputs, preventing the storage of malicious XSS payloads submitted via the CSRF attack vector in the plugin.
SC-23 provides session authenticity mechanisms such as unique tokens, directly countering the CSRF exploitation that tricks authenticated users into storing XSS payloads.