Cyber Resilience

CVE-2025-30620

High

Published: 24 March 2025

Published
24 March 2025
Modified
23 April 2026
KEV Added
Patch
CVSS Score v3.1 7.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L
EPSS Score 0.0006 20.1th percentile
Risk Priority 14 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2025-30620 is a high-severity CSRF (CWE-352) vulnerability. Its CVSS base score is 7.1 (High).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 20.1th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

The strongest mitigations our analysis identified are NIST 800-53 SC-23 (Session Authenticity) and SI-10 (Information Input Validation).

Deeper analysis

CVE-2025-30620 is a Cross-Site Request Forgery (CSRF) vulnerability in the WP Odoo Form Integrator WordPress plugin by coderscom, which allows Stored XSS. The issue affects all versions of the plugin from n/a through 1.1.0 and is associated with CWE-352.

Unauthenticated attackers (PR:N) can exploit this vulnerability remotely over the network (AV:N) with low attack complexity (AC:L) by tricking a user into interacting with a malicious request (UI:R), such as clicking a crafted link or submitting a forged form. Successful exploitation enables Stored XSS, allowing attackers to inject and persist malicious scripts, with low impacts to confidentiality, integrity, and availability (C:L/I:L/A:L) but a changed scope (S:C), resulting in a CVSS v3.1 base score of 7.1.

Mitigation details are available in the Patchstack advisory at https://patchstack.com/database/Wordpress/Plugin/wp-odoo-form-integrator/vulnerability/wordpress-wp-odoo-form-integrator-plugin-1-1-0-csrf-to-stored-xss-vulnerability?_s_id=cve.

EU & UK References

Vulnerability details

Cross-Site Request Forgery (CSRF) vulnerability in coderscom WP Odoo Form Integrator wp-odoo-form-integrator allows Stored XSS.This issue affects WP Odoo Form Integrator: from n/a through <= 1.1.0.

CWE(s)

Related Threats

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
T1059.007 JavaScript Execution
Adversaries may abuse various implementations of JavaScript for execution.
Why these techniques?

CSRF to Stored XSS in public-facing WordPress plugin directly enables T1190 (Exploit Public-Facing Application) for remote exploitation and T1059.007 (JavaScript) via persistent malicious script injection.

Confidence: HIGH · MITRE ATT&CK Enterprise v19.0

CVEs Like This One

CVE-2025-28931Shared CWE-352
CVE-2025-23980Shared CWE-352
CVE-2025-23710Shared CWE-352
CVE-2025-23822Shared CWE-352
CVE-2025-25128Shared CWE-352
CVE-2025-31616Shared CWE-352
CVE-2025-23483Shared CWE-352
CVE-2025-23817Shared CWE-352
CVE-2025-23446Shared CWE-352
CVE-2025-23664Shared CWE-352

Affected Assets

Mitigating Controls

Mitigating Controls (NIST 800-53 r5) AI

prevent

Directly prevents CSRF exploitation in the WP Odoo Form Integrator plugin by enforcing session authenticity mechanisms such as anti-CSRF tokens to block forged requests leading to stored XSS.

prevent

Validates and sanitizes inputs to the vulnerable form integrator to block malicious scripts injected via CSRF attacks, preventing stored XSS.

prevent

Ensures timely remediation of the specific CSRF-to-stored XSS flaw in WP Odoo Form Integrator versions through <=1.1.0 by identifying, reporting, and patching the vulnerability.

References