CVE-2025-30771: WP Cassify DOM-Based XSS Vulnerability

CVE-2025-30771 Overview

CVE-2025-30771 is a DOM-Based Cross-Site Scripting (XSS) vulnerability in the WP Cassify WordPress plugin developed by Alain-Aymerick FRANCOIS. The flaw affects all versions of WP Cassify up to and including 2.3.5. The plugin integrates WordPress with Central Authentication Service (CAS) servers, making it common in academic and enterprise deployments. Attackers can inject malicious client-side scripts that execute in a victim's browser when the victim interacts with a crafted request. The issue is categorized under [CWE-79] and requires user interaction to trigger.

Critical Impact
Successful exploitation allows attackers to execute arbitrary JavaScript in a victim's browser session, enabling credential theft, session hijacking, and unauthorized actions within the scope of the authenticated user.

Affected Products

WP Cassify plugin for WordPress
All versions from initial release through 2.3.5
WordPress sites using CAS authentication via WP Cassify

Discovery Timeline

2025-03-27 - CVE-2025-30771 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-30771

Vulnerability Analysis

The vulnerability is a DOM-Based Cross-Site Scripting flaw in the WP Cassify plugin. DOM-Based XSS occurs when client-side JavaScript writes attacker-controlled data into the Document Object Model without proper sanitization or encoding. The malicious payload never needs to touch the server, which limits the effectiveness of traditional server-side filtering.

An attacker crafts a URL or request containing script content in a parameter consumed by the plugin's client-side code. When a logged-in user follows the crafted link, the browser renders the injected script in the context of the vulnerable WordPress origin. Because the attack executes in the victim's authenticated session, the attacker inherits the victim's privileges within the browser.

The scope change indicated in the CVSS vector reflects that impact extends beyond the vulnerable component itself. In WordPress environments, this can mean impact on administrative dashboards or other plugins sharing the same origin.

Root Cause

The root cause is improper neutralization of input during web page generation [CWE-79]. Client-side code in WP Cassify writes untrusted input into DOM sinks without escaping HTML metacharacters or validating the content. Common vulnerable sinks include innerHTML, document.write, and jQuery methods such as .html().

Attack Vector

Exploitation is network-based but requires user interaction. An attacker delivers a crafted URL through phishing, forum posts, or malicious advertisements. The attacker also needs low privileges within the target application. When a victim visits the URL on a WordPress site running a vulnerable WP Cassify version, the DOM sink processes the payload and executes attacker-controlled JavaScript. Technical details are documented in the Patchstack advisory.

Detection Methods for CVE-2025-30771

Indicators of Compromise

HTTP requests to WordPress URLs containing encoded <script> tags, javascript: URIs, or event handlers such as onerror= and onload= in query parameters or URL fragments
Unexpected outbound requests from browser sessions to attacker-controlled domains shortly after users visit pages served by WP Cassify
Anomalous WordPress administrator session activity, including account creation or plugin changes originating from unusual IPs

Detection Strategies

Inspect web server and reverse proxy logs for URL parameters targeting WP Cassify endpoints that contain HTML or JavaScript metacharacters
Deploy a Web Application Firewall (WAF) rule set targeting reflected and DOM-based XSS patterns on WordPress deployments
Correlate browser telemetry with WordPress authentication events to identify script execution against authenticated administrators

Monitoring Recommendations

Enable and centralize WordPress access logs, PHP error logs, and WAF alerts for review by the security operations team
Monitor installed plugin versions across all WordPress instances and alert when wp-cassify remains at 2.3.5 or earlier
Track Content Security Policy (CSP) violation reports to surface unexpected inline script execution

How to Mitigate CVE-2025-30771

Immediate Actions Required

Identify every WordPress site running the WP Cassify plugin and record the installed version
Restrict administrative access to trusted networks and enforce multi-factor authentication on privileged WordPress accounts
Instruct users and administrators to avoid clicking untrusted links pointing to WordPress sites using WP Cassify

Patch Information

At the time of publication, the Patchstack advisory lists all versions up to and including 2.3.5 as affected. Administrators should upgrade to a fixed release published by the plugin author once available, or remove the plugin if a patched version is not yet released.

Workarounds

Deactivate and remove the WP Cassify plugin until a patched version is installed, and use an alternative CAS integration if authentication is required
Deploy a strict Content Security Policy that disallows inline scripts and restricts script sources to trusted origins
Configure a WAF to block requests containing common XSS payload patterns targeting WP Cassify endpoints

bash

# Example Content Security Policy header for WordPress via .htaccess
Header set Content-Security-Policy "default-src 'self'; script-src 'self'; object-src 'none'; base-uri 'self'; frame-ancestors 'self'"