Cyber Posture

CVE-2025-30522

High

Published: 24 March 2025

Published
24 March 2025
Modified
23 April 2026
KEV Added
—
Patch
—
CVSS Score 7.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L
EPSS Score 0.0016 36.5th percentile
Risk Priority 14 60% EPSS · 20% KEV · 20% CVSS

Description

Adversaries may abuse various implementations of JavaScript for execution.

Security Summary

CVE-2025-30522 is a Cross-Site Request Forgery (CSRF) vulnerability in the Damian Orzol Contact Form 7 Material Design WordPress plugin (cf7-material-design) that allows Stored XSS. The issue affects the plugin from unknown initial versions through version 1.0.0.

Attackers with network access can exploit this vulnerability without authentication privileges, though it requires low complexity and user interaction. Per the CVSS 3.1 score of 7.1 (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L), exploitation changes the scope and enables limited impacts on confidentiality, integrity, and availability through stored XSS payloads injected via forged requests.

Patchstack has documented the vulnerability in its database, detailing the CSRF-to-Stored XSS issue in Contact Form 7 Material Design version 1.0.0. Security practitioners should consult the advisory at the provided reference for mitigation recommendations.

Details

CWE(s)
CWE-352

MITRE ATT&CK Enterprise Techniques

T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
attack.mitre.org →
T1059.007 JavaScript Execution
Adversaries may abuse various implementations of JavaScript for execution.
attack.mitre.org →
Why these techniques?

CSRF-to-stored XSS in public-facing WordPress plugin directly enables T1190 exploitation of public-facing apps; stored XSS payload facilitates arbitrary JavaScript execution in victim browsers via T1059.007.

Confidence: HIGH · MITRE ATT&CK Enterprise v19.0

References