CVE-2025-30612
Published: 24 March 2025
Summary
CVE-2025-30612 is a high-severity CSRF (CWE-352) vulnerability. Its CVSS base score is 7.1 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 20.1th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SC-23 (Session Authenticity) and SI-10 (Information Input Validation).
Deeper analysis
CVE-2025-30612 is a Cross-Site Request Forgery (CSRF) vulnerability in the WordPress plugin Replace Default Words (also referred to as replace-default-words) by mandegarweb, which enables Stored XSS. The issue affects all versions of the plugin from its initial release through version 1.3 inclusive. It is classified under CWE-352 and carries a CVSS v3.1 base score of 7.1 (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L), indicating network accessibility, low attack complexity, no required privileges, user interaction, changed scope, and low impacts across confidentiality, integrity, and availability.
An unauthenticated attacker can exploit this vulnerability by crafting a malicious webpage that, when visited by a targeted user (such as a site administrator), triggers a CSRF request to the plugin. This results in the storage of malicious XSS payloads, which can then execute in the browsers of subsequent users viewing affected pages, potentially leading to session hijacking, data theft, or further site compromise.
Mitigation details are available in the Patchstack advisory at https://patchstack.com/database/Wordpress/Plugin/replace-default-words/vulnerability/wordpress-replace-default-words-plugin-1-3-cross-site-request-forgery-csrf-to-stored-xss-vulnerability?_s_id=cve. Security practitioners should advise updating the plugin beyond version 1.3 where possible and implementing CSRF protections such as tokens in administrative forms.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-7910
Vulnerability details
Cross-Site Request Forgery (CSRF) vulnerability in mandegarweb Replace Default Words replace-default-words allows Stored XSS.This issue affects Replace Default Words: from n/a through <= 1.3.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
The CVE describes exploitation of a public-facing WordPress plugin vulnerability (T1190) via CSRF to achieve stored XSS, directly enabling client-side JavaScript execution in user browsers (T1059.007) for impacts like session hijacking.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly mitigates the CVE by requiring timely flaw remediation, such as updating the Replace Default Words plugin beyond version 1.3 to fix the CSRF-to-stored XSS vulnerability.
Enforces session authenticity mechanisms like CSRF tokens to prevent unauthenticated attackers from tricking users into storing malicious XSS payloads via forged requests.
Validates information inputs to the plugin to block malicious XSS payloads from being accepted and stored during CSRF exploitation.