Cyber Posture

CVE-2025-30583

High

Published: 24 March 2025

Published
24 March 2025
Modified
23 April 2026
KEV Added
Patch
CVSS Score 7.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L
EPSS Score 0.0022 44.7th percentile
Risk Priority 14 60% EPSS · 20% KEV · 20% CVSS

Description

Adversaries may abuse various implementations of JavaScript for execution.

Security Summary

CVE-2025-30583 is a Cross-Site Request Forgery (CSRF) vulnerability, classified under CWE-352, in the Pro Rank Tracker WordPress plugin (proranktracker). This flaw allows for Stored XSS and affects all versions from n/a through 1.0.0. The vulnerability was published on 2025-03-24T14:15:30.353 and carries a CVSS v3.1 base score of 7.1 (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L).

Attackers can exploit this vulnerability remotely over the network with low attack complexity and no required privileges, though it necessitates user interaction. By tricking authenticated users into performing a CSRF-protected action via a malicious site or resource, attackers can inject and store XSS payloads. This leads to low-level impacts on confidentiality, integrity, and availability with a changed scope, potentially allowing execution of arbitrary scripts in the context of affected users.

The Patchstack advisory provides further details on this WordPress plugin vulnerability, including potential mitigation guidance, accessible at https://patchstack.com/database/Wordpress/Plugin/proranktracker/vulnerability/wordpress-pro-rank-tracker-plugin-1-0-0-csrf-to-stored-xss-vulnerability?_s_id=cve.

Details

CWE(s)
CWE-352

MITRE ATT&CK Enterprise Techniques

T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
T1059.007 JavaScript Execution
Adversaries may abuse various implementations of JavaScript for execution.
Why these techniques?

The CVE describes a remote CSRF vulnerability in a public-facing WordPress plugin that leads to stored XSS, directly enabling exploitation of public-facing applications (T1190) and arbitrary JavaScript execution in the browser context of affected users (T1059.007).

Confidence: HIGH · MITRE ATT&CK Enterprise v19.0

References