CVE-2025-30564 Overview
CVE-2025-30564 is a Cross-Site Request Forgery (CSRF) vulnerability in the wpwox Custom Script Integration plugin for WordPress. The flaw affects all versions up to and including 2.1. An attacker can chain the CSRF condition with Stored Cross-Site Scripting (XSS) to persist malicious script content within the WordPress site. Successful exploitation requires tricking an authenticated administrator into visiting an attacker-controlled page or link. The weakness is classified under CWE-352: Cross-Site Request Forgery.
Critical Impact
An attacker who lures an authenticated WordPress administrator to a crafted page can inject persistent JavaScript that executes in the browser of any user viewing affected pages, enabling session theft, defacement, or further account takeover.
Affected Products
- wpwox Custom Script Integration plugin for WordPress
- All versions from n/a through <= 2.1
- WordPress sites running the custom-script-integration plugin
Discovery Timeline
- 2025-03-24 - CVE-2025-30564 published to NVD
- 2026-04-23 - Last updated in NVD database
Technical Details for CVE-2025-30564
Vulnerability Analysis
The vulnerability stems from missing or insufficient CSRF protection on plugin actions that accept script content. The Custom Script Integration plugin allows administrators to add custom JavaScript or HTML snippets to a WordPress site. Because state-changing requests do not validate an anti-CSRF nonce or origin, an attacker can forge a request from a third-party context.
When an authenticated administrator visits an attacker-controlled page, the browser submits the forged request using the administrator's existing session cookies. The plugin then stores attacker-supplied script content. The stored payload subsequently executes in every browser that loads the affected page, producing a Stored XSS condition. User interaction is required, which limits opportunistic exploitation but does not prevent targeted attacks against site operators.
Root Cause
The root cause is the absence of CSRF token verification on administrative endpoints that modify stored script content. Without nonce validation through wp_verify_nonce() or capability checks tied to a request token, the plugin cannot distinguish between an intentional administrator action and a forged cross-origin submission.
Attack Vector
The attack is delivered over the network and requires user interaction. An attacker hosts a page containing an auto-submitting form or fetch call that targets the vulnerable plugin endpoint. A logged-in administrator who visits the page triggers the request. The injected payload is stored in the WordPress database and rendered to subsequent visitors, yielding script execution in their session context.
No proof-of-concept exploit code is available in public sources. See the Patchstack WordPress Vulnerability Report for advisory details.
Detection Methods for CVE-2025-30564
Indicators of Compromise
- Unexpected <script> tags or external JavaScript references stored in Custom Script Integration plugin settings
- Administrator account activity that modifies plugin configuration shortly after visiting unfamiliar external sites
- Outbound browser requests from site visitors to unknown domains after page load
Detection Strategies
- Review the WordPress wp_options table and plugin-specific options for unauthorized changes to script content
- Inspect web server access logs for POST requests to plugin admin endpoints originating with a Referer header outside the site domain
- Compare current plugin settings against a known-good baseline to identify injected payloads
Monitoring Recommendations
- Enable WordPress audit logging to capture changes to plugin options and administrator actions
- Monitor for new outbound network connections initiated from administrator browsers when accessing the WordPress admin panel
- Alert on responses containing script tags served from pages that should not include inline JavaScript
How to Mitigate CVE-2025-30564
Immediate Actions Required
- Deactivate the wpwox Custom Script Integration plugin if no patched version is available for your environment
- Audit all stored script content within the plugin and remove any entries not added by authorized administrators
- Force password resets and invalidate active sessions for WordPress administrator accounts if compromise is suspected
Patch Information
At the time of publication, the Patchstack advisory lists affected versions through <= 2.1. Site operators should consult the Patchstack WordPress Vulnerability Report and the official WordPress plugin repository for the latest fixed release. Apply the vendor patch as soon as it becomes available.
Workarounds
- Remove the plugin and implement custom scripts through a hardened alternative such as a code snippets plugin with nonce-protected forms
- Restrict WordPress admin panel access to specific IP addresses through web server or firewall rules
- Require administrators to use a dedicated browser profile for WordPress administration to reduce cross-site request exposure
- Deploy a web application firewall rule that blocks state-changing requests to the plugin endpoint without a valid same-origin Referer header
# Example: restrict WordPress admin access by IP using .htaccess
<Files wp-admin>
Require ip 203.0.113.0/24
</Files>
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
