CVE-2025-30560

CVE-2025-30560 is a Cross-Site Request Forgery (CSRF) vulnerability in the Sana Ullah jQuery Dropdown Menu plugin (jquery-drop-down-menu-plugin) for WordPress that enables Stored Cross-Site Scripting (XSS). The issue affects all versions of the plugin from its initial release through version 3.0 inclusive, as documented under CWE-352.

Attackers can exploit this vulnerability without privileges over the network by tricking an authenticated WordPress user into submitting a malicious request, such as through a crafted webpage or link that the user interacts with. Successful exploitation stores an XSS payload on the site, which executes in the context of other users viewing affected pages, potentially leading to session hijacking, data theft, or further site compromise. The CVSS v3.1 base score of 7.1 (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L) reflects high severity due to network accessibility, low attack complexity, required user interaction, and scope change with low impacts on confidentiality, integrity, and availability.

The Patchstack advisory at https://patchstack.com/database/Wordpress/Plugin/jquery-drop-down-menu-plugin/vulnerability/wordpress-jquery-dropdown-menu-plugin-3-0-csrf-to-stored-xss-vulnerability?_s_id=cve provides details on this CSRF-to-Stored XSS vulnerability in the WordPress plugin version 3.0. Security practitioners should review this reference for mitigation guidance, including any available patches or workarounds.