CVE-2025-30603
Published: 24 March 2025
Summary
CVE-2025-30603 is a high-severity CSRF (CWE-352) vulnerability. Its CVSS base score is 7.1 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 20.1th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SC-23 (Session Authenticity) and SI-10 (Information Input Validation).
Deeper analysis
CVE-2025-30603 is a Cross-Site Request Forgery (CSRF) vulnerability, classified under CWE-352, in the DEJAN CopyLink (copy-link) WordPress plugin that enables Stored Cross-Site Scripting (XSS). The issue affects all versions of the plugin from its initial release through 1.1 inclusive. It received a CVSS v3.1 base score of 7.1 (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L), highlighting its network accessibility and potential for scope change despite requiring user interaction.
An unauthenticated attacker (PR:N) can exploit this vulnerability over the network (AV:N) with low attack complexity (AC:L), but it requires user interaction (UI:R), such as tricking an authenticated user into visiting a malicious site or clicking a forged link. Exploitation via CSRF allows the attacker to induce the storage of malicious XSS payloads, potentially leading to low-level impacts on confidentiality, integrity, and availability (C:L/I:L/A:L) within a changed security scope (S:C), such as session hijacking or further site compromise for affected users.
The primary advisory from Patchstack (https://patchstack.com/database/Wordpress/Plugin/copy-link/vulnerability/wordpress-copylink-plugin-1-1-csrf-to-stored-xss-vulnerability?_s_id=cve) documents this CSRF-to-Stored XSS issue specifically in CopyLink version 1.1. Practitioners should consult the advisory for detailed mitigation steps, including plugin updates beyond version 1.1 where available, input validation, or CSRF token implementation.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-7913
Vulnerability details
Cross-Site Request Forgery (CSRF) vulnerability in DEJAN CopyLink copy-link allows Stored XSS.This issue affects CopyLink: from n/a through <= 1.1.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
CSRF-to-stored-XSS in public-facing WordPress plugin directly enables T1190 (exploit public-facing app), T1204.001 (malicious link to trick user), and T1185 (browser session hijacking via injected XSS payload).
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Enforces session authenticity mechanisms like CSRF tokens to prevent unauthenticated attackers from tricking users into storing malicious XSS payloads via forged requests.
Validates inputs to the vulnerable CopyLink endpoint to block malicious XSS scripts from being accepted and stored.
Remediates the specific CSRF-to-Stored XSS flaw in DEJAN CopyLink versions through 1.1 by applying timely patches or updates as recommended in the advisory.