Cyber Resilience

CVE-2025-30631

High

Published: 06 January 2026

Published
06 January 2026
Modified
23 April 2026
KEV Added
—
Patch
—
CVSS Score v3.1 7.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L
EPSS Score 0.0003 7.3th percentile
Risk Priority 14 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2025-30631 is a high-severity Cross-site Scripting (CWE-79) vulnerability. Its CVSS base score is 7.1 (High).

Operationally, exploitation aligns with the MITRE ATT&CK technique Spearphishing Link (T1566.002); ranked at the 7.3th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-15 (Information Output Filtering).

Deeper analysis

CVE-2025-30631 is an Improper Neutralization of Input During Web Page Generation vulnerability, enabling Reflected Cross-site Scripting (XSS) as classified under CWE-79. It affects the AA-Team Amazon Affiliates Addon for WPBakery Page Builder (formerly Visual Composer), with the plugin slug azon-addon-js-composer, in all versions from n/a through 1.2 inclusive.

The vulnerability carries a CVSS v3.1 base score of 7.1 (High), with attack vector AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L. Unauthenticated attackers with network access can exploit it through low-complexity methods that require user interaction, such as tricking a victim into visiting a malicious URL. Exploitation executes arbitrary JavaScript in the victim's browser, achieving low impacts on confidentiality, integrity, and availability, while the changed scope (S:C) indicates potential effects on components beyond the vulnerable addon.

Mitigation details are available in advisories such as the Patchstack database entry at https://patchstack.com/database/Wordpress/Plugin/azon-addon-js-composer/vulnerability/wordpress-amazon-affiliates-addon-for-wpbakery-page-builder-formerly-visual-composer-1-2-cross-site-scripting-xss-vulnerability?_s_id=cve.

EU & UK References

Vulnerability details

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in AA-Team Amazon Affiliates Addon for WPBakery Page Builder (formerly Visual Composer) azon-addon-js-composer allows Reflected XSS.This issue affects Amazon Affiliates Addon for WPBakery Page Builder (formerly Visual Composer): from…

more

n/a through <= 1.2.

CWE(s)
CWE-79

Related Threats

MITRE ATT&CK Enterprise TechniquesAI

T1566.002 Spearphishing Link Initial Access
Adversaries may send spearphishing emails with a malicious link in an attempt to gain access to victim systems.
attack.mitre.org →
Why these techniques?

Reflected XSS enables arbitrary JS execution via malicious URLs, directly facilitating spearphishing link delivery requiring user interaction.

Confidence: MEDIUM · MITRE ATT&CK Enterprise v18.1

CVEs Like This One

CVE-2025-23596Shared CWE-79
CVE-2026-22523Shared CWE-79
CVE-2025-23653Shared CWE-79
CVE-2025-23578Shared CWE-79
CVE-2025-23857Shared CWE-79
CVE-2025-22575Shared CWE-79
CVE-2025-23753Shared CWE-79
CVE-2025-28903Shared CWE-79
CVE-2025-23547Shared CWE-79
CVE-2025-26554Shared CWE-79

Affected Assets

Mitigating Controls

Mitigating Controls (NIST 800-53 r5) AI

SI-10 Information Input Validation good match
prevent

Directly requires validation and neutralization of untrusted input before it is reflected in web page output, preventing the reflected XSS described in CVE-2025-30631.

SI-15 Information Output Filtering good match
prevent

Requires filtering of information output to remove or encode potentially malicious content such as scripts, directly mitigating the improper neutralization flaw in the WPBakery addon.

AC-4 Information Flow Enforcement partial match
prevent

Enforces information flow rules that can require sanitization or encoding of data crossing trust boundaries before it is rendered in responses.

References