CVE-2025-30603 Overview
CVE-2025-30603 is a Cross-Site Request Forgery (CSRF) vulnerability in the DEJAN CopyLink WordPress plugin that enables Stored Cross-Site Scripting (XSS). The flaw affects CopyLink versions up to and including 1.1. An attacker can craft a malicious request that, when triggered by an authenticated administrator visiting a controlled page, injects persistent JavaScript into the plugin's stored configuration. The injected payload executes in the browser of any user who subsequently loads the affected page. The issue is tracked under CWE-352: Cross-Site Request Forgery.
Critical Impact
Successful exploitation leads to persistent script execution in administrator sessions, enabling session theft, account takeover, and further compromise of the WordPress site.
Affected Products
- DEJAN CopyLink WordPress plugin versions through 1.1
- WordPress installations with the CopyLink plugin enabled
- Administrator accounts authenticated to vulnerable WordPress sites
Discovery Timeline
- 2025-03-24 - CVE-2025-30603 published to NVD
- 2026-04-23 - Last updated in NVD database
Technical Details for CVE-2025-30603
Vulnerability Analysis
The vulnerability combines two weaknesses in the CopyLink plugin. First, a state-changing endpoint lacks proper CSRF protection, meaning requests are not validated with a nonce or anti-forgery token. Second, user-controlled input passed through that endpoint is stored without adequate sanitization or output encoding, producing a Stored XSS sink.
An attacker hosts a malicious page containing a forged request targeting the vulnerable CopyLink endpoint. When a logged-in administrator visits the attacker-controlled page, the browser submits the request using the administrator's session cookies. The plugin persists the attacker-supplied payload, and the script executes whenever the affected view renders.
User interaction is required because the attack depends on tricking an authenticated victim into visiting an external page. The scope is changed because injected scripts execute in the trusted origin of the WordPress site, affecting resources beyond the initial vulnerable component.
Root Cause
The root cause is missing CSRF protection on a settings or content endpoint combined with insufficient input sanitization. WordPress provides wp_nonce_field() and check_admin_referer() to mitigate CSRF, and wp_kses() or esc_attr() for output encoding. The CopyLink plugin omitted these controls in the affected code path.
Attack Vector
The attack vector is network-based and requires social engineering. An attacker delivers a phishing link or embeds a hidden form on a page an administrator is likely to visit. Once the victim loads the page, the forged request executes silently and the malicious JavaScript is stored in the plugin configuration. Subsequent administrator visits to the affected page trigger script execution, enabling cookie theft, plugin installation, or creation of attacker-controlled accounts. See the Patchstack Vulnerability Report for technical details.
Detection Methods for CVE-2025-30603
Indicators of Compromise
- Unexpected <script> tags or JavaScript event handlers stored in CopyLink plugin options within the wp_options table
- Outbound HTTP requests from administrator browsers to unknown domains after visiting WordPress admin pages
- New administrator accounts or modified user roles created without corresponding audit log entries
- POST requests to CopyLink endpoints with Referer headers pointing to external domains
Detection Strategies
- Review the wp_options table for CopyLink-related entries containing HTML or JavaScript content
- Inspect web server access logs for POST requests to CopyLink admin endpoints lacking valid nonces
- Deploy a Web Application Firewall (WAF) rule that flags cross-origin POST requests to WordPress plugin endpoints
Monitoring Recommendations
- Enable WordPress activity logging to capture plugin setting changes with user, IP, and timestamp
- Monitor for anomalous administrator session activity, including logins from unusual geolocations
- Alert on creation of new privileged accounts or modifications to existing administrator roles
How to Mitigate CVE-2025-30603
Immediate Actions Required
- Update the CopyLink plugin to a version newer than 1.1 once a patched release is available from the vendor
- Deactivate and remove the CopyLink plugin if a patch is not yet published
- Audit the wp_options table and CopyLink settings for injected scripts and remove any malicious content
- Force password resets for all administrator accounts and invalidate active sessions
Patch Information
At the time of publication, no fixed version is documented in the available references. Consult the Patchstack Vulnerability Report for the latest remediation status and vendor updates.
Workarounds
- Disable the CopyLink plugin until a patched version is released
- Restrict WordPress admin access using IP allowlisting at the web server or firewall level
- Require administrators to use separate browser profiles or sessions for WordPress administration to reduce CSRF exposure
- Deploy a WAF rule to block POST requests to CopyLink endpoints that lack a same-origin Referer header
# Example: disable the CopyLink plugin via WP-CLI
wp plugin deactivate copy-link
wp plugin delete copy-link
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
