CVE-2025-30620
Published: 24 March 2025
Summary
CVE-2025-30620 is a high-severity CSRF (CWE-352) vulnerability. Its CVSS base score is 7.1 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 20.1th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SC-23 (Session Authenticity) and SI-10 (Information Input Validation).
Deeper analysis
CVE-2025-30620 is a Cross-Site Request Forgery (CSRF) vulnerability in the WP Odoo Form Integrator WordPress plugin by coderscom, which allows Stored XSS. The issue affects all versions of the plugin from n/a through 1.1.0 and is associated with CWE-352.
Unauthenticated attackers (PR:N) can exploit this vulnerability remotely over the network (AV:N) with low attack complexity (AC:L) by tricking a user into interacting with a malicious request (UI:R), such as clicking a crafted link or submitting a forged form. Successful exploitation enables Stored XSS, allowing attackers to inject and persist malicious scripts, with low impacts to confidentiality, integrity, and availability (C:L/I:L/A:L) but a changed scope (S:C), resulting in a CVSS v3.1 base score of 7.1.
Mitigation details are available in the Patchstack advisory at https://patchstack.com/database/Wordpress/Plugin/wp-odoo-form-integrator/vulnerability/wordpress-wp-odoo-form-integrator-plugin-1-1-0-csrf-to-stored-xss-vulnerability?_s_id=cve.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-7918
Vulnerability details
Cross-Site Request Forgery (CSRF) vulnerability in coderscom WP Odoo Form Integrator wp-odoo-form-integrator allows Stored XSS.This issue affects WP Odoo Form Integrator: from n/a through <= 1.1.0.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
CSRF to Stored XSS in public-facing WordPress plugin directly enables T1190 (Exploit Public-Facing Application) for remote exploitation and T1059.007 (JavaScript) via persistent malicious script injection.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly prevents CSRF exploitation in the WP Odoo Form Integrator plugin by enforcing session authenticity mechanisms such as anti-CSRF tokens to block forged requests leading to stored XSS.
Validates and sanitizes inputs to the vulnerable form integrator to block malicious scripts injected via CSRF attacks, preventing stored XSS.
Ensures timely remediation of the specific CSRF-to-stored XSS flaw in WP Odoo Form Integrator versions through <=1.1.0 by identifying, reporting, and patching the vulnerability.