Cyber Posture

CVE-2025-30602

High

Published: 24 March 2025

Published
24 March 2025
Modified
23 April 2026
KEV Added
—
Patch
—
CVSS Score 7.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L
EPSS Score 0.0009 24.8th percentile
Risk Priority 14 60% EPSS · 20% KEV · 20% CVSS

Description

Adversaries may abuse various implementations of JavaScript for execution.

Security Summary

CVE-2025-30602 is an Improper Neutralization of Input During Web Page Generation vulnerability, classified as Stored Cross-site Scripting (XSS) under CWE-79, in the WordPress plugin Related Posts via Categories developed by alphasis. The issue affects the plugin from its initial release through version 2.1.2.

Attackers can exploit this vulnerability over the network (AV:N) with low attack complexity (AC:L), no privileges required (PR:N), but it requires user interaction (UI:R). The CVSS v3.1 base score of 7.1 (S:C/C:L/I:L/A:L) indicates that exploitation, potentially via a CSRF-to-Stored XSS vector as noted in advisories, allows injection of malicious scripts that persist on the site and execute in victims' browsers when viewing affected pages, enabling low impacts on confidentiality, integrity, and availability across a changed scope.

The Patchstack advisory provides details on this CSRF-to-Stored XSS vulnerability in Related Posts via Categories version 2.1.2, including mitigation guidance.

Details

CWE(s)
CWE-79

MITRE ATT&CK Enterprise Techniques

T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
attack.mitre.org →
T1059.007 JavaScript Execution
Adversaries may abuse various implementations of JavaScript for execution.
attack.mitre.org →
Why these techniques?

Stored XSS in public-facing WordPress plugin enables T1190 for exploiting the web application and T1059.007 for injecting/executing malicious JavaScript in victim browsers.

Confidence: HIGH · MITRE ATT&CK Enterprise v19.0

References