CVE-2025-30783

High

Published: 27 March 2025

Published

27 March 2025

Modified

23 April 2026

KEV Added

—

Patch

—

CVSS Score v3.1 8.2 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:L

EPSS Score 0.0019 40.7th percentile

Risk Priority 17 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2025-30783 is a high-severity CSRF (CWE-352) vulnerability. Its CVSS base score is 8.2 (High).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 40.7th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

The strongest mitigations our analysis identified are NIST 800-53 SC-23 (Session Authenticity) and SI-10 (Information Input Validation).

Deeper analysis

CVE-2025-30783 is a Cross-Site Request Forgery (CSRF) vulnerability, classified under CWE-352, in the WP Google Review Slider plugin (wp-google-places-review-slider) for WordPress, developed by jgwhite33. The flaw enables SQL Injection and affects all versions from n/a through 16.0 inclusive. It received a CVSS v3.1 base score of 8.2 (AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:L), indicating high severity due to network accessibility, low attack complexity, no required privileges, user interaction, changed scope, high confidentiality impact, and low availability impact.

An attacker can exploit this vulnerability remotely without authentication by tricking a legitimate user—likely an authenticated WordPress administrator or editor—into performing a malicious action, such as visiting a crafted webpage or clicking a link. This triggers the CSRF-protected endpoint lacking proper token validation, leading to SQL Injection execution. Successful exploitation allows the attacker to extract sensitive data from the database, achieving high confidentiality impact, while causing limited availability disruption.

Mitigation details are available in the Patchstack advisory at https://patchstack.com/database/Wordpress/Plugin/wp-google-places-review-slider/vulnerability/wordpress-wp-google-review-slider-plugin-16-0-csrf-to-sql-injection-vulnerability?_s_id=cve.

EU & UK References

🇪🇺 ENISA EUVD: EUVD-2025-8371

Vulnerability details

Cross-Site Request Forgery (CSRF) vulnerability in jgwhite33 WP Google Review Slider wp-google-places-review-slider allows SQL Injection.This issue affects WP Google Review Slider: from n/a through <= 16.0.

CWE(s): CWE-352

Related Threats

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access

Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.

attack.mitre.org →

Why these techniques?

CSRF vulnerability in public-facing WordPress plugin directly enables remote exploitation of the application via SQL Injection for database data extraction.

Confidence: HIGH · MITRE ATT&CK Enterprise v19.0