CVE-2025-30587
Published: 24 March 2025
Description
Adversaries may take advantage of security vulnerabilities and inherent functionality in browser software to change content, modify user-behaviors, and intercept information as part of various browser session hijacking techniques.
Security Summary
CVE-2025-30587 is a Cross-Site Request Forgery (CSRF) vulnerability in the LH OGP Meta Tags WordPress plugin developed by shawfactor, which enables Stored Cross-Site Scripting (XSS). The flaw, associated with CWE-352, affects all versions of the LH OGP Meta plugin up to and including 1.73. It was published on 2025-03-24 and carries a CVSS v3.1 base score of 7.1 (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L).
An unauthenticated attacker can exploit this vulnerability remotely with low attack complexity by tricking an authenticated user—typically an administrator or editor with plugin configuration privileges—into interacting with a malicious webpage, such as via a crafted link or form submission. This bypasses CSRF protections, allowing the injection of malicious payloads that result in stored XSS on the target site. The stored script executes in the browser context of subsequent visitors, potentially leading to session hijacking, data theft, or further site compromise, though impacts are rated low for confidentiality, integrity, and availability due to the changed scope.
Mitigation details are available in the Patchstack advisory at https://patchstack.com/database/Wordpress/Plugin/lh-ogp-meta-tags/vulnerability/wordpress-lh-ogp-meta-plugin-1-73-csrf-to-stored-xss-vulnerability?_s_id=cve, which documents the vulnerability in the LH OGP Meta plugin version 1.73.
Details
- CWE(s)
MITRE ATT&CK Enterprise Techniques
Why these techniques?
CVE enables exploitation of public-facing WordPress plugin (T1190) via CSRF to stored XSS; stored XSS directly facilitates browser session hijacking and data theft in victim browsers (T1185).