CVE-2025-30560 Overview
CVE-2025-30560 is a Cross-Site Request Forgery (CSRF) vulnerability in the Sana Ullah jquery-drop-down-menu-plugin WordPress plugin. The flaw enables an attacker to chain CSRF with Stored Cross-Site Scripting (XSS), persisting malicious script payloads through forged authenticated requests. The vulnerability affects all versions of jQuery Dropdown Menu up to and including version 3.0. The weakness is classified under CWE-352: Cross-Site Request Forgery. Exploitation requires user interaction, typically an authenticated administrator clicking a crafted link or visiting an attacker-controlled page.
Critical Impact
An attacker can plant persistent JavaScript in a WordPress site by tricking a logged-in administrator into triggering a forged request, leading to session theft, account takeover, or further site compromise.
Affected Products
- Sana Ullah jQuery Dropdown Menu plugin for WordPress
- All versions from n/a through <= 3.0
- WordPress sites with the jquery-drop-down-menu-plugin installed and active
Discovery Timeline
- 2025-03-24 - CVE-2025-30560 published to the National Vulnerability Database (NVD)
- 2026-04-23 - Last updated in NVD database
Technical Details for CVE-2025-30560
Vulnerability Analysis
The vulnerability combines two weaknesses in the jQuery Dropdown Menu plugin. State-changing administrative endpoints lack anti-CSRF token validation, allowing attackers to forge requests on behalf of authenticated users. Those same endpoints fail to sanitize or encode user-supplied input before storing it, producing Stored XSS when the saved data is later rendered in the admin interface or front end.
An attacker hosts a malicious page containing an auto-submitting HTML form or JavaScript that issues a request to the plugin's settings endpoint on the target site. If a WordPress administrator visits that page while authenticated, the browser attaches the session cookies and the request executes with full privileges. The injected payload persists in the database and runs whenever the affected page is loaded.
Root Cause
The plugin omits WordPress nonce verification, such as wp_verify_nonce() or check_admin_referer(), on its administrative save handlers. It also fails to apply output encoding through functions such as esc_html(), esc_attr(), or wp_kses() before rendering stored values. The combination converts a CSRF flaw into a persistent script injection.
Attack Vector
Exploitation occurs over the network and requires user interaction from an authenticated administrator. The attacker delivers a crafted link through phishing, a forum post, or a watering-hole page. Once the request executes, the XSS payload is stored and triggers on subsequent page loads. The scope change in the CVSS vector reflects that the injected script runs in the security context of the WordPress site rather than the attacker's origin.
No verified public proof-of-concept code is available. See the Patchstack Vulnerability Report for the upstream advisory.
Detection Methods for CVE-2025-30560
Indicators of Compromise
- Unexpected <script>, onerror, or onload attributes stored in plugin configuration rows within the WordPress database.
- Outbound HTTP requests from administrator browsers to unfamiliar domains after visiting external links.
- New or modified WordPress administrator accounts created shortly after an admin session.
- Web server access logs showing POST requests to plugin settings endpoints with a Referer header pointing to an external domain.
Detection Strategies
- Inspect plugin option values in the wp_options table for HTML or JavaScript content where plain text is expected.
- Review web server logs for state-changing requests to jquery-drop-down-menu-plugin endpoints lacking a same-origin Referer.
- Deploy a web application firewall rule that flags requests to plugin admin handlers without a valid nonce parameter.
Monitoring Recommendations
- Enable WordPress audit logging to capture changes to plugin settings and administrator accounts.
- Alert on Content Security Policy (CSP) violation reports from administrator sessions.
- Monitor for anomalous JavaScript execution in admin dashboard sessions using browser-side telemetry where available.
How to Mitigate CVE-2025-30560
Immediate Actions Required
- Deactivate and remove the jquery-drop-down-menu-plugin until a patched version is confirmed available.
- Audit the WordPress database for injected scripts in plugin-managed options and purge malicious entries.
- Rotate administrator passwords and invalidate active sessions to evict any attacker-established persistence.
- Review recent administrator activity logs for unauthorized configuration or user changes.
Patch Information
No vendor-supplied fixed version is identified in the available advisory data. The plugin remains vulnerable through version 3.0. Consult the Patchstack Vulnerability Report for updates on remediation status.
Workarounds
- Replace the plugin with a maintained alternative that provides equivalent dropdown menu functionality.
- Restrict access to /wp-admin/ by IP allowlist to reduce CSRF exposure for administrator accounts.
- Enforce a strict Content Security Policy that blocks inline script execution in the admin interface.
- Require administrators to use isolated browser profiles for WordPress management to limit cross-site request risk.
# Example: disable the vulnerable plugin via WP-CLI
wp plugin deactivate jquery-drop-down-menu-plugin
wp plugin delete jquery-drop-down-menu-plugin
# Audit stored options for script content
wp db query "SELECT option_name, option_value FROM wp_options \
WHERE option_value LIKE '%<script%' OR option_value LIKE '%onerror=%';"
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
