CVE-2025-30919
Published: 27 March 2025
Description
An adversary may rely upon a user clicking a malicious link in order to gain execution.
Security Summary
CVE-2025-30919 is a Cross-Site Request Forgery (CSRF) vulnerability, classified under CWE-352, in the Store Locator Widget WordPress plugin (store-locator-widget) that enables Stored XSS. This issue affects all versions of the plugin up to and including 2025r2, as published on 2025-03-27.
The vulnerability has a CVSS v3.1 base score of 7.1 (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L), indicating it is exploitable over the network with low complexity, no required privileges, and user interaction. An unauthenticated attacker can craft a malicious webpage or request to trick a victim into performing an unintended action via CSRF, leading to the storage of XSS payloads within the store locator widget. Successful exploitation allows execution of arbitrary scripts in the context of other users viewing the widget, with low impacts on confidentiality, integrity, and availability but changed scope for broader effects.
The Patchstack advisory at https://patchstack.com/database/Wordpress/Plugin/store-locator-widget/vulnerability/wordpress-store-locator-widget-plugin-20200131-csrf-to-stored-xss-vulnerability?_s_id=cve provides further details on this CSRF-to-Stored XSS vulnerability in the plugin.
Details
- CWE(s)
MITRE ATT&CK Enterprise Techniques
Why these techniques?
The CSRF-to-stored-XSS vulnerability in a public-facing WordPress plugin is directly exploitable over the network via a crafted malicious link or webpage that tricks an authenticated user into performing the unintended action, enabling initial access through public application exploitation and user execution.