CVE-2025-30584
Published: 24 March 2025
Summary
CVE-2025-30584 is a high-severity CSRF (CWE-352) vulnerability. Its CVSS base score is 7.1 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 36.7th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SC-23 (Session Authenticity) and SI-10 (Information Input Validation).
Deeper analysis
CVE-2025-30584 is a Cross-Site Request Forgery (CSRF) vulnerability, classified under CWE-352, in the AlphaOmega Captcha & Anti-Spam Filter WordPress plugin developed by alphaomegaplugins. The flaw enables Stored Cross-Site Scripting (XSS) and affects all versions of the plugin from unspecified initial releases through 3.3 inclusive. Published on 2025-03-24, it carries a CVSS v3.1 base score of 7.1 (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L).
Attackers can exploit this vulnerability remotely without requiring authentication privileges. By tricking an authenticated user, such as a site administrator, into visiting a malicious webpage or clicking a crafted link, the attacker can force a state-changing request to the vulnerable plugin endpoint. This results in the storage of a malicious XSS payload on the target site, which executes in the context of other users' browsers due to the changed scope, enabling potential theft of session data or further site compromise with low impacts across confidentiality, integrity, and availability.
Mitigation details are available in the Patchstack advisory at https://patchstack.com/database/Wordpress/Plugin/alphaomega-captcha-anti-spam/vulnerability/wordpress-alphaomega-captcha-anti-spam-filter-plugin-3-3-csrf-to-stored-xss-vulnerability?_s_id=cve.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-7941
Vulnerability details
Cross-Site Request Forgery (CSRF) vulnerability in alphaomegaplugins AlphaOmega Captcha & Anti-Spam Filter alphaomega-captcha-anti-spam allows Stored XSS.This issue affects AlphaOmega Captcha & Anti-Spam Filter: from n/a through <= 3.3.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
CSRF to stored XSS in public-facing WordPress plugin directly enables T1190 (exploit public-facing app), T1059.007 (JavaScript execution via XSS payload), and T1185 (browser session hijacking for session theft).
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
SC-23 requires mechanisms such as anti-CSRF tokens to verify session authenticity for state-changing requests, directly preventing the forged requests that store malicious XSS payloads in this CVE.
SI-10 enforces validation of inputs to the plugin endpoint, rejecting malicious XSS payloads before they are stored via the CSRF attack.
SI-15 applies output filtering and encoding to prevent execution of any stored XSS payloads in the context of other users' browsers.