CVE-2025-30919
Published: 27 March 2025
Summary
CVE-2025-30919 is a high-severity CSRF (CWE-352) vulnerability. Its CVSS base score is 7.1 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 46.7% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SC-23 (Session Authenticity) and SI-10 (Information Input Validation).
Deeper analysis
CVE-2025-30919 is a Cross-Site Request Forgery (CSRF) vulnerability, classified under CWE-352, in the Store Locator Widget WordPress plugin (store-locator-widget) that enables Stored XSS. This issue affects all versions of the plugin up to and including 2025r2, as published on 2025-03-27.
The vulnerability has a CVSS v3.1 base score of 7.1 (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L), indicating it is exploitable over the network with low complexity, no required privileges, and user interaction. An unauthenticated attacker can craft a malicious webpage or request to trick a victim into performing an unintended action via CSRF, leading to the storage of XSS payloads within the store locator widget. Successful exploitation allows execution of arbitrary scripts in the context of other users viewing the widget, with low impacts on confidentiality, integrity, and availability but changed scope for broader effects.
The Patchstack advisory at https://patchstack.com/database/Wordpress/Plugin/store-locator-widget/vulnerability/wordpress-store-locator-widget-plugin-20200131-csrf-to-stored-xss-vulnerability?_s_id=cve provides further details on this CSRF-to-Stored XSS vulnerability in the plugin.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-8299
Vulnerability details
Cross-Site Request Forgery (CSRF) vulnerability in Store Locator Widgets Store Locator Widget store-locator-widget allows Stored XSS.This issue affects Store Locator Widget: from n/a through <= 2025r2.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
The CSRF-to-stored-XSS vulnerability in a public-facing WordPress plugin is directly exploitable over the network via a crafted malicious link or webpage that tricks an authenticated user into performing the unintended action, enabling initial access through public application exploitation and user execution.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
SC-23 enforces session authenticity mechanisms like anti-CSRF tokens, directly preventing the forged requests that exploit this CSRF-to-Stored XSS vulnerability.
SI-10 validates information inputs to block malicious XSS payloads from being stored via the CSRF attack in the store locator widget.
SI-15 filters information outputs to neutralize any stored XSS payloads executed when users view the compromised store locator widget.