CVE-2025-30769

High

Published: 27 March 2025

Published

27 March 2025

Modified

23 April 2026

KEV Added

—

Patch

—

CVSS Score v3.1 7.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L

EPSS Score 0.0022 45.0th percentile

Risk Priority 14 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2025-30769 is a high-severity CSRF (CWE-352) vulnerability. Its CVSS base score is 7.1 (High).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 45.0th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

The strongest mitigations our analysis identified are NIST 800-53 SC-23 (Session Authenticity) and SI-10 (Information Input Validation).

Deeper analysis

CVE-2025-30769 is a Cross-Site Request Forgery (CSRF) vulnerability in the WIP WooCarousel Lite WordPress plugin (wip-woocarousel-lite) by alexvtn that allows Stored XSS. The issue affects all versions from n/a through 1.1.7, as documented under CWE-352.

Unauthenticated attackers can exploit this vulnerability remotely over the network with low attack complexity and no privileges required, though user interaction is necessary. Successful exploitation via CSRF enables the storage of XSS payloads, resulting in low impacts to confidentiality, integrity, and availability with a changed scope, per its CVSS v3.1 base score of 7.1 (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L).

The Patchstack advisory provides further details on this vulnerability at https://patchstack.com/database/Wordpress/Plugin/wip-woocarousel-lite/vulnerability/wordpress-wip-woocarousel-lite-plugin-1-1-7-cross-site-request-forgery-csrf-to-stored-xss-vulnerability?_s_id=cve.

EU & UK References

🇪🇺 ENISA EUVD: EUVD-2025-8396

Vulnerability details

Cross-Site Request Forgery (CSRF) vulnerability in alexvtn WIP WooCarousel Lite wip-woocarousel-lite allows Stored XSS.This issue affects WIP WooCarousel Lite: from n/a through <= 1.1.7.

CWE(s): CWE-352

Related Threats

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access

Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.

attack.mitre.org →

T1059.007 JavaScript Execution

Adversaries may abuse various implementations of JavaScript for execution.

attack.mitre.org →

Why these techniques?

The vulnerability is a remote CSRF leading to Stored XSS in a public-facing WordPress plugin, directly enabling exploitation of public-facing applications (T1190) and facilitating arbitrary JavaScript execution via the injected XSS payload (T1059.007).

Confidence: HIGH · MITRE ATT&CK Enterprise v19.0