Cyber Posture

CVE-2025-30857

High

Published: 27 March 2025

Published
27 March 2025
Modified
23 April 2026
KEV Added
Patch
CVSS Score 7.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L
EPSS Score 0.0008 23.4th percentile
Risk Priority 14 60% EPSS · 20% KEV · 20% CVSS

Description

Adversaries may abuse various implementations of JavaScript for execution.

Security Summary

CVE-2025-30857 is a Cross-Site Request Forgery (CSRF) vulnerability in the PressMaximum Currency Switcher for WooCommerce plugin (currency-switcher-for-woocommerce) that allows Stored XSS. The issue affects the plugin from unspecified initial versions through 0.0.7.

Unauthenticated attackers can exploit this vulnerability over the network with low attack complexity and no privileges required, though it demands user interaction such as clicking a malicious link or performing a forged request. Exploitation enables the storage of XSS payloads, potentially leading to script execution in the browsers of site users who view affected content, with low impacts on confidentiality, integrity, and availability under a changed scope (CVSS 7.1; CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L).

The Patchstack advisory provides further details on this vulnerability, including vulnerability assessment for the WordPress Currency Switcher for WooCommerce plugin version 0.0.7, available at https://patchstack.com/database/Wordpress/Plugin/currency-switcher-for-woocommerce/vulnerability/wordpress-currency-switcher-for-woocommerce-plugin-0-0-7-csrf-to-stored-xss-vulnerability?_s_id=cve.

Details

CWE(s)
CWE-352

MITRE ATT&CK Enterprise Techniques

T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
T1059.007 JavaScript Execution
Adversaries may abuse various implementations of JavaScript for execution.
Why these techniques?

CSRF to stored XSS in public-facing WordPress plugin enables remote exploitation of web applications (T1190) and facilitates JavaScript execution via injected payloads in user browsers (T1059.007).

Confidence: HIGH · MITRE ATT&CK Enterprise v19.0

References