CVE-2025-30578

High

Published: 24 March 2025

Published

24 March 2025

Modified

23 April 2026

KEV Added

—

Patch

—

CVSS Score v3.1 7.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L

EPSS Score 0.0016 36.7th percentile

Risk Priority 14 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2025-30578 is a high-severity CSRF (CWE-352) vulnerability. Its CVSS base score is 7.1 (High).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 36.7th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

The strongest mitigations our analysis identified are NIST 800-53 SC-23 (Session Authenticity) and SI-10 (Information Input Validation).

Deeper analysis

CVE-2025-30578 is a Cross-Site Request Forgery (CSRF) vulnerability in the hotvanrod AdSense Privacy Policy WordPress plugin (adsense-privacy-policy) that enables Stored XSS. Published on 2025-03-24, it affects all versions from unknown initial release through 1.1.1 and is associated with CWE-352. The CVSS v3.1 base score is 7.1 (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L), indicating high severity due to network accessibility, low attack complexity, and scope change despite requiring user interaction.

Attackers without privileges can exploit this over the network by tricking authenticated users, typically site administrators, into visiting a malicious webpage that submits a forged request. This bypasses CSRF protections, allowing injection of malicious payloads that result in stored XSS, enabling script execution in the site's context with low impacts on confidentiality, integrity, and availability but potential for broader compromise through persistent cross-site scripting.

Patchstack advisories detail the vulnerability in the WordPress plugin, available at https://patchstack.com/database/Wordpress/Plugin/adsense-privacy-policy/vulnerability/wordpress-adsense-privacy-policy-plugin-1-1-1-cross-site-request-forgery-csrf-to-stored-xss-vulnerability?_s_id=cve, where security practitioners can find guidance on verification, patches, and mitigation steps.

EU & UK References

🇪🇺 ENISA EUVD: EUVD-2025-7943

Vulnerability details

Cross-Site Request Forgery (CSRF) vulnerability in hotvanrod AdSense Privacy Policy adsense-privacy-policy allows Stored XSS.This issue affects AdSense Privacy Policy: from n/a through <= 1.1.1.

CWE(s): CWE-352

Related Threats

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access

Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.

attack.mitre.org →

T1059.007 JavaScript Execution

Adversaries may abuse various implementations of JavaScript for execution.

attack.mitre.org →

Why these techniques?

CSRF to Stored XSS in public-facing WordPress plugin directly enables exploitation of public-facing applications (T1190) and client-side JavaScript execution via persistent XSS (T1059.007).

Confidence: HIGH · MITRE ATT&CK Enterprise v19.0