CVE-2025-30612

CVE-2025-30612 is a Cross-Site Request Forgery (CSRF) vulnerability in the WordPress plugin Replace Default Words (also referred to as replace-default-words) by mandegarweb, which enables Stored XSS. The issue affects all versions of the plugin from its initial release through version 1.3 inclusive. It is classified under CWE-352 and carries a CVSS v3.1 base score of 7.1 (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L), indicating network accessibility, low attack complexity, no required privileges, user interaction, changed scope, and low impacts across confidentiality, integrity, and availability.

An unauthenticated attacker can exploit this vulnerability by crafting a malicious webpage that, when visited by a targeted user (such as a site administrator), triggers a CSRF request to the plugin. This results in the storage of malicious XSS payloads, which can then execute in the browsers of subsequent users viewing affected pages, potentially leading to session hijacking, data theft, or further site compromise.

Mitigation details are available in the Patchstack advisory at https://patchstack.com/database/Wordpress/Plugin/replace-default-words/vulnerability/wordpress-replace-default-words-plugin-1-3-cross-site-request-forgery-csrf-to-stored-xss-vulnerability?_s_id=cve. Security practitioners should advise updating the plugin beyond version 1.3 where possible and implementing CSRF protections such as tokens in administrative forms.