Cyber Posture

CVE-2025-30587

High

Published: 24 March 2025

Published
24 March 2025
Modified
23 April 2026
KEV Added
Patch
CVSS Score 7.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L
EPSS Score 0.0022 44.7th percentile
Risk Priority 14 60% EPSS · 20% KEV · 20% CVSS

Description

Adversaries may take advantage of security vulnerabilities and inherent functionality in browser software to change content, modify user-behaviors, and intercept information as part of various browser session hijacking techniques.

Security Summary

CVE-2025-30587 is a Cross-Site Request Forgery (CSRF) vulnerability in the LH OGP Meta Tags WordPress plugin developed by shawfactor, which enables Stored Cross-Site Scripting (XSS). The flaw, associated with CWE-352, affects all versions of the LH OGP Meta plugin up to and including 1.73. It was published on 2025-03-24 and carries a CVSS v3.1 base score of 7.1 (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L).

An unauthenticated attacker can exploit this vulnerability remotely with low attack complexity by tricking an authenticated user—typically an administrator or editor with plugin configuration privileges—into interacting with a malicious webpage, such as via a crafted link or form submission. This bypasses CSRF protections, allowing the injection of malicious payloads that result in stored XSS on the target site. The stored script executes in the browser context of subsequent visitors, potentially leading to session hijacking, data theft, or further site compromise, though impacts are rated low for confidentiality, integrity, and availability due to the changed scope.

Mitigation details are available in the Patchstack advisory at https://patchstack.com/database/Wordpress/Plugin/lh-ogp-meta-tags/vulnerability/wordpress-lh-ogp-meta-plugin-1-73-csrf-to-stored-xss-vulnerability?_s_id=cve, which documents the vulnerability in the LH OGP Meta plugin version 1.73.

Details

CWE(s)
CWE-352

MITRE ATT&CK Enterprise Techniques

T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
T1185 Browser Session Hijacking Collection
Adversaries may take advantage of security vulnerabilities and inherent functionality in browser software to change content, modify user-behaviors, and intercept information as part of various browser session hijacking techniques.
Why these techniques?

CVE enables exploitation of public-facing WordPress plugin (T1190) via CSRF to stored XSS; stored XSS directly facilitates browser session hijacking and data theft in victim browsers (T1185).

Confidence: HIGH · MITRE ATT&CK Enterprise v19.0

References