CVE-2025-30587
Published: 24 March 2025
Summary
CVE-2025-30587 is a high-severity CSRF (CWE-352) vulnerability. Its CVSS base score is 7.1 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 36.7th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SC-23 (Session Authenticity) and SI-10 (Information Input Validation).
Deeper analysis
CVE-2025-30587 is a Cross-Site Request Forgery (CSRF) vulnerability in the LH OGP Meta Tags WordPress plugin developed by shawfactor, which enables Stored Cross-Site Scripting (XSS). The flaw, associated with CWE-352, affects all versions of the LH OGP Meta plugin up to and including 1.73. It was published on 2025-03-24 and carries a CVSS v3.1 base score of 7.1 (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L).
An unauthenticated attacker can exploit this vulnerability remotely with low attack complexity by tricking an authenticated user—typically an administrator or editor with plugin configuration privileges—into interacting with a malicious webpage, such as via a crafted link or form submission. This bypasses CSRF protections, allowing the injection of malicious payloads that result in stored XSS on the target site. The stored script executes in the browser context of subsequent visitors, potentially leading to session hijacking, data theft, or further site compromise, though impacts are rated low for confidentiality, integrity, and availability due to the changed scope.
Mitigation details are available in the Patchstack advisory at https://patchstack.com/database/Wordpress/Plugin/lh-ogp-meta-tags/vulnerability/wordpress-lh-ogp-meta-plugin-1-73-csrf-to-stored-xss-vulnerability?_s_id=cve, which documents the vulnerability in the LH OGP Meta plugin version 1.73.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-7917
Vulnerability details
Cross-Site Request Forgery (CSRF) vulnerability in shawfactor LH OGP Meta lh-ogp-meta-tags allows Stored XSS.This issue affects LH OGP Meta: from n/a through <= 1.73.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
CVE enables exploitation of public-facing WordPress plugin (T1190) via CSRF to stored XSS; stored XSS directly facilitates browser session hijacking and data theft in victim browsers (T1185).
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
SC-23 enforces session authenticity mechanisms like anti-CSRF tokens, directly preventing unauthorized state-changing requests that exploit the plugin's CSRF vulnerability.
SI-10 requires validation of information inputs to the plugin, blocking malicious XSS payloads injected via CSRF exploitation.
SI-15 mandates output filtering and encoding, preventing execution of stored XSS payloads resulting from the CSRF vulnerability.