CVE-2025-30630 Overview
CVE-2025-30630 is a stored Cross-Site Scripting (XSS) vulnerability in the pozzad Global Translator WordPress plugin. The flaw affects all versions of Global Translator up to and including 2.0.2. The vulnerability stems from improper neutralization of user-supplied input during web page generation, classified under [CWE-79]. An authenticated attacker with high privileges can inject persistent JavaScript payloads that execute in the browsers of users who view the affected pages. The scope is changed, meaning injected scripts can affect resources beyond the vulnerable component itself.
Critical Impact
Stored XSS enables persistent script execution against site visitors and administrators, potentially leading to session theft, administrative account compromise, and content manipulation on affected WordPress sites.
Affected Products
- pozzad Global Translator WordPress plugin, versions up to and including 2.0.2
- WordPress installations with the Global Translator plugin activated
- Any site relying on global-translator for multi-language content
Discovery Timeline
- 2025-06-06 - CVE-2025-30630 published to the National Vulnerability Database (NVD)
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2025-30630
Vulnerability Analysis
The vulnerability is a stored XSS flaw in the global-translator plugin. Stored XSS occurs when user-supplied input is written to persistent storage without adequate sanitization or output encoding. When another user later loads a page containing that data, the browser interprets the injected payload as executable script.
Exploitation requires an authenticated account with elevated privileges and some form of user interaction from the victim. Despite these prerequisites, the changed scope allows injected scripts to reach administrative interfaces or other components beyond the plugin itself.
Successful exploitation can result in session hijacking, credential theft through fake login prompts, forced administrative actions via CSRF chaining, and defacement of translated content served to site visitors.
Root Cause
The root cause is missing or inadequate input sanitization and output encoding within the Global Translator plugin. Data supplied through plugin inputs is stored in the WordPress database and later rendered into HTML pages without escaping HTML entities or filtering script tags. WordPress provides sanitization helpers such as sanitize_text_field(), wp_kses_post(), and esc_html(), but the vulnerable code paths in versions through 2.0.2 do not apply these consistently.
Attack Vector
The attack vector is network-based and requires an authenticated attacker with high privileges. The attacker submits a crafted payload containing JavaScript through a plugin input field. The payload is persisted in the WordPress database. When a victim, including administrators or site visitors, loads a page that renders the stored value, the payload executes in the victim's browser context.
See the Patchstack XSS Vulnerability Report for additional technical detail on the affected code paths.
Detection Methods for CVE-2025-30630
Indicators of Compromise
- Unexpected <script> tags, onerror=, or onload= attributes stored in WordPress wp_options or plugin-specific tables associated with global-translator.
- Outbound requests from browser sessions to unfamiliar domains after visiting pages rendered by the Global Translator plugin.
- Unauthorized administrator account creation or privilege changes following visits to translated pages.
Detection Strategies
- Audit WordPress database records populated by the global-translator plugin for HTML tags, JavaScript event handlers, and encoded script payloads.
- Deploy a Web Application Firewall (WAF) rule set to inspect POST parameters submitted to plugin endpoints for XSS signatures.
- Review WordPress access logs for authenticated requests to plugin administration endpoints followed by anomalous page loads by other users.
Monitoring Recommendations
- Enable Content Security Policy (CSP) reporting to capture blocked inline script execution attempts on pages served by the plugin.
- Monitor WordPress user activity logs for privilege changes, new administrator accounts, and unexpected plugin configuration edits.
- Alert on browser-side telemetry showing script execution originating from translated content or plugin-rendered DOM elements.
How to Mitigate CVE-2025-30630
Immediate Actions Required
- Deactivate and remove the Global Translator plugin until a patched version is available, since no fixed release is currently identified.
- Rotate credentials for all WordPress administrator and editor accounts that may have interacted with the plugin.
- Review the WordPress database for stored payloads and purge any injected scripts from plugin-managed records.
Patch Information
No vendor patch is referenced in the advisory data for versions beyond 2.0.2. Site owners should consult the Patchstack XSS Vulnerability Report for the latest remediation status and monitor the WordPress plugin repository for updates.
Workarounds
- Restrict plugin administration privileges to a minimal set of trusted accounts and enforce multi-factor authentication (MFA) on those accounts.
- Deploy a WAF virtual patch that blocks XSS payloads submitted to global-translator endpoints.
- Apply a strict Content Security Policy (CSP) that disallows inline scripts and unauthorized external script sources.
- Replace the plugin with an alternative translation solution that receives active security maintenance.
# Configuration example
# Example restrictive Content Security Policy header for Apache
Header set Content-Security-Policy "default-src 'self'; script-src 'self'; object-src 'none'; base-uri 'self'; frame-ancestors 'self'"
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.