CVE-2025-30564
Published: 24 March 2025
Summary
CVE-2025-30564 is a high-severity CSRF (CWE-352) vulnerability. Its CVSS base score is 7.1 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 28.2th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SC-23 (Session Authenticity) and SI-10 (Information Input Validation).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
SC-23 requires session authenticity mechanisms like anti-CSRF tokens to prevent forged requests that trick authenticated users into storing malicious scripts.
SI-10 enforces validation of information inputs to block malicious scripts from being accepted and stored via the CSRF vector.
SI-15 applies output filtering to prevent execution of any stored malicious scripts when pages are viewed by other users.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
The CSRF vulnerability in a public-facing WordPress plugin enables exploitation of public-facing applications (T1190); the resulting stored XSS directly facilitates browser session hijacking by executing malicious scripts in victim browsers (T1185).
NVD Description
Cross-Site Request Forgery (CSRF) vulnerability in wpwox Custom Script Integration custom-script-integration allows Stored XSS.This issue affects Custom Script Integration: from n/a through <= 2.1.
Deeper analysisAI
CVE-2025-30564 is a Cross-Site Request Forgery (CSRF) vulnerability in the wpwox Custom Script Integration WordPress plugin (custom-script-integration) that allows Stored XSS. This issue affects all versions from n/a through 2.1 inclusive.
The vulnerability can be exploited over the network (AV:N) with low attack complexity (AC:L), requiring no privileges (PR:N) but user interaction (UI:R), and changes scope (S:C) to achieve low impacts on confidentiality, integrity, and availability (C:L/I:L/A:L), for an overall CVSS v3.1 score of 7.1. An unauthenticated attacker can trick an authenticated user into performing a state-changing action via a forged request, leading to the storage of malicious scripts that execute in the context of other users viewing affected pages.
The Patchstack advisory provides details on this WordPress plugin vulnerability, available at https://patchstack.com/database/Wordpress/Plugin/custom-script-integration/vulnerability/wordpress-custom-script-integration-2-1-cross-site-request-forgery-csrf-vulnerability?_s_id=cve.
Details
- CWE(s)