CVE-2025-30583
Published: 24 March 2025
Summary
CVE-2025-30583 is a high-severity CSRF (CWE-352) vulnerability. Its CVSS base score is 7.1 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 36.7th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SC-23 (Session Authenticity) and SI-10 (Information Input Validation).
Deeper analysis
CVE-2025-30583 is a Cross-Site Request Forgery (CSRF) vulnerability, classified under CWE-352, in the Pro Rank Tracker WordPress plugin (proranktracker). This flaw allows for Stored XSS and affects all versions from n/a through 1.0.0. The vulnerability was published on 2025-03-24T14:15:30.353 and carries a CVSS v3.1 base score of 7.1 (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L).
Attackers can exploit this vulnerability remotely over the network with low attack complexity and no required privileges, though it necessitates user interaction. By tricking authenticated users into performing a CSRF-protected action via a malicious site or resource, attackers can inject and store XSS payloads. This leads to low-level impacts on confidentiality, integrity, and availability with a changed scope, potentially allowing execution of arbitrary scripts in the context of affected users.
The Patchstack advisory provides further details on this WordPress plugin vulnerability, including potential mitigation guidance, accessible at https://patchstack.com/database/Wordpress/Plugin/proranktracker/vulnerability/wordpress-pro-rank-tracker-plugin-1-0-0-csrf-to-stored-xss-vulnerability?_s_id=cve.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-7938
Vulnerability details
Cross-Site Request Forgery (CSRF) vulnerability in ProRankTracker Pro Rank Tracker proranktracker allows Stored XSS.This issue affects Pro Rank Tracker: from n/a through <= 1.0.0.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
The CVE describes a remote CSRF vulnerability in a public-facing WordPress plugin that leads to stored XSS, directly enabling exploitation of public-facing applications (T1190) and arbitrary JavaScript execution in the browser context of affected users (T1059.007).
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
SC-23 enforces session authenticity protections such as CSRF tokens, directly preventing unauthorized state-changing requests that exploit this vulnerability.
SI-10 requires input validation and sanitization at entry points, blocking malicious XSS payloads injected via CSRF in the Pro Rank Tracker plugin.
SI-15 filters outputs to prevent execution of stored XSS payloads resulting from successful CSRF exploitation in affected plugin versions.