Cyber Resilience

CVE-2025-30564

High

Published: 24 March 2025

Published
24 March 2025
Modified
23 April 2026
KEV Added
—
Patch
—
CVSS Score v3.1 7.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L
EPSS Score 0.0011 28.2th percentile
Risk Priority 14 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2025-30564 is a high-severity CSRF (CWE-352) vulnerability. Its CVSS base score is 7.1 (High).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 28.2th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

The strongest mitigations our analysis identified are NIST 800-53 SC-23 (Session Authenticity) and SI-10 (Information Input Validation).

Deeper analysis

CVE-2025-30564 is a Cross-Site Request Forgery (CSRF) vulnerability in the wpwox Custom Script Integration WordPress plugin (custom-script-integration) that allows Stored XSS. This issue affects all versions from n/a through 2.1 inclusive.

The vulnerability can be exploited over the network (AV:N) with low attack complexity (AC:L), requiring no privileges (PR:N) but user interaction (UI:R), and changes scope (S:C) to achieve low impacts on confidentiality, integrity, and availability (C:L/I:L/A:L), for an overall CVSS v3.1 score of 7.1. An unauthenticated attacker can trick an authenticated user into performing a state-changing action via a forged request, leading to the storage of malicious scripts that execute in the context of other users viewing affected pages.

The Patchstack advisory provides details on this WordPress plugin vulnerability, available at https://patchstack.com/database/Wordpress/Plugin/custom-script-integration/vulnerability/wordpress-custom-script-integration-2-1-cross-site-request-forgery-csrf-vulnerability?_s_id=cve.

EU & UK References

Vulnerability details

Cross-Site Request Forgery (CSRF) vulnerability in wpwox Custom Script Integration custom-script-integration allows Stored XSS.This issue affects Custom Script Integration: from n/a through <= 2.1.

CWE(s)
CWE-352

Related Threats

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
attack.mitre.org →
T1185 Browser Session Hijacking Collection
Adversaries may take advantage of security vulnerabilities and inherent functionality in browser software to change content, modify user-behaviors, and intercept information as part of various browser session hijacking techniques.
attack.mitre.org →
Why these techniques?

The CSRF vulnerability in a public-facing WordPress plugin enables exploitation of public-facing applications (T1190); the resulting stored XSS directly facilitates browser session hijacking by executing malicious scripts in victim browsers (T1185).

Confidence: HIGH · MITRE ATT&CK Enterprise v19.0

CVEs Like This One

CVE-2025-23900Shared CWE-352
CVE-2026-29784Shared CWE-352
CVE-2025-25140Shared CWE-352
CVE-2025-23567Shared CWE-352
CVE-2025-31443Shared CWE-352
CVE-2025-31444Shared CWE-352
CVE-2025-22690Shared CWE-352
CVE-2025-26577Shared CWE-352
CVE-2025-30587Shared CWE-352
CVE-2025-23501Shared CWE-352

Affected Assets

Mitigating Controls

Mitigating Controls (NIST 800-53 r5) AI

SC-23 Session Authenticity good match
prevent

SC-23 requires session authenticity mechanisms like anti-CSRF tokens to prevent forged requests that trick authenticated users into storing malicious scripts.

SI-10 Information Input Validation good match
prevent

SI-10 enforces validation of information inputs to block malicious scripts from being accepted and stored via the CSRF vector.

SI-15 Information Output Filtering good match
prevent

SI-15 applies output filtering to prevent execution of any stored malicious scripts when pages are viewed by other users.

References