CVE-2025-30586
Published: 24 March 2025
Summary
CVE-2025-30586 is a high-severity CSRF (CWE-352) vulnerability. Its CVSS base score is 7.1 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 36.5th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SC-23 (Session Authenticity) and SI-10 (Information Input Validation).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
Enforces session authenticity to prevent CSRF attacks that trick authenticated users into storing malicious XSS payloads via forged requests.
Validates and sanitizes user inputs to block injection of malicious XSS payloads enabled by the CSRF vulnerability.
Filters and encodes information outputs to prevent execution of any stored XSS payloads resulting from the CSRF exploitation.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
The CSRF vulnerability in the public-facing WordPress plugin directly enables exploitation of the web application (T1190) and injection of Stored XSS payloads that execute arbitrary JavaScript in the victim's browser context (T1059.007).
NVD Description
Cross-Site Request Forgery (CSRF) vulnerability in bbodine1 cTabs ctabs allows Stored XSS.This issue affects cTabs: from n/a through <= 1.3.
Deeper analysisAI
CVE-2025-30586 is a Cross-Site Request Forgery (CSRF) vulnerability in the bbodine1 cTabs WordPress plugin, affecting all versions from n/a through 1.3 inclusive. Published on 2025-03-24, the flaw allows Stored XSS and is classified under CWE-352 with a CVSS v3.1 base score of 7.1 (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L).
Attackers can exploit this vulnerability remotely with low complexity and no required privileges, though it necessitates user interaction, such as tricking an authenticated administrator into visiting a malicious webpage. Exploitation via CSRF enables injection of Stored XSS payloads, which execute in the context of the plugin with changed scope, leading to low-level impacts on confidentiality, integrity, and availability.
The Patchstack advisory (https://patchstack.com/database/Wordpress/Plugin/ctabs/vulnerability/wordpress-ctabs-plugin-1-3-csrf-to-stored-xss-vulnerability?_s_id=cve) documents the CSRF-to-Stored XSS vulnerability specifically in cTabs version 1.3 for WordPress.
Details
- CWE(s)