Cyber Posture

CVE-2025-30769

High

Published: 27 March 2025

Published
27 March 2025
Modified
23 April 2026
KEV Added
—
Patch
—
CVSS Score 7.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L
EPSS Score 0.0008 23.4th percentile
Risk Priority 14 60% EPSS · 20% KEV · 20% CVSS

Description

Adversaries may abuse various implementations of JavaScript for execution.

Security Summary

CVE-2025-30769 is a Cross-Site Request Forgery (CSRF) vulnerability in the WIP WooCarousel Lite WordPress plugin (wip-woocarousel-lite) by alexvtn that allows Stored XSS. The issue affects all versions from n/a through 1.1.7, as documented under CWE-352.

Unauthenticated attackers can exploit this vulnerability remotely over the network with low attack complexity and no privileges required, though user interaction is necessary. Successful exploitation via CSRF enables the storage of XSS payloads, resulting in low impacts to confidentiality, integrity, and availability with a changed scope, per its CVSS v3.1 base score of 7.1 (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L).

The Patchstack advisory provides further details on this vulnerability at https://patchstack.com/database/Wordpress/Plugin/wip-woocarousel-lite/vulnerability/wordpress-wip-woocarousel-lite-plugin-1-1-7-cross-site-request-forgery-csrf-to-stored-xss-vulnerability?_s_id=cve.

Details

CWE(s)
CWE-352

MITRE ATT&CK Enterprise Techniques

T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
attack.mitre.org →
T1059.007 JavaScript Execution
Adversaries may abuse various implementations of JavaScript for execution.
attack.mitre.org →
Why these techniques?

The vulnerability is a remote CSRF leading to Stored XSS in a public-facing WordPress plugin, directly enabling exploitation of public-facing applications (T1190) and facilitating arbitrary JavaScript execution via the injected XSS payload (T1059.007).

Confidence: HIGH · MITRE ATT&CK Enterprise v19.0

References