CVE-2025-30583
Published: 24 March 2025
Description
Adversaries may abuse various implementations of JavaScript for execution.
Security Summary
CVE-2025-30583 is a Cross-Site Request Forgery (CSRF) vulnerability, classified under CWE-352, in the Pro Rank Tracker WordPress plugin (proranktracker). This flaw allows for Stored XSS and affects all versions from n/a through 1.0.0. The vulnerability was published on 2025-03-24T14:15:30.353 and carries a CVSS v3.1 base score of 7.1 (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L).
Attackers can exploit this vulnerability remotely over the network with low attack complexity and no required privileges, though it necessitates user interaction. By tricking authenticated users into performing a CSRF-protected action via a malicious site or resource, attackers can inject and store XSS payloads. This leads to low-level impacts on confidentiality, integrity, and availability with a changed scope, potentially allowing execution of arbitrary scripts in the context of affected users.
The Patchstack advisory provides further details on this WordPress plugin vulnerability, including potential mitigation guidance, accessible at https://patchstack.com/database/Wordpress/Plugin/proranktracker/vulnerability/wordpress-pro-rank-tracker-plugin-1-0-0-csrf-to-stored-xss-vulnerability?_s_id=cve.
Details
- CWE(s)
MITRE ATT&CK Enterprise Techniques
Why these techniques?
The CVE describes a remote CSRF vulnerability in a public-facing WordPress plugin that leads to stored XSS, directly enabling exploitation of public-facing applications (T1190) and arbitrary JavaScript execution in the browser context of affected users (T1059.007).