CVE-2025-30779: Doneren met Mollie XSS Vulnerability

CVE-2025-30779 Overview

CVE-2025-30779 is a stored Cross-Site Scripting (XSS) vulnerability in the Doneren met Mollie WordPress plugin developed by Nick van Wobbie. The flaw affects all plugin versions up to and including 2.10.7. It stems from improper neutralization of user-supplied input during web page generation, classified as [CWE-79]. An authenticated attacker with low privileges can inject malicious scripts that persist in the application and execute in the browsers of other users who view affected pages. Successful exploitation requires user interaction and results in a scope change, meaning the injected payload can affect resources beyond the vulnerable component.

Critical Impact
Attackers with low-privileged accounts can inject persistent JavaScript payloads that execute against site visitors and administrators, enabling session theft, content manipulation, and further account compromise.

Affected Products

Doneren met Mollie WordPress plugin (doneren-met-mollie)
All versions from initial release through 2.10.7
WordPress sites accepting donations via the Mollie payment gateway integration

Discovery Timeline

2025-03-27 - CVE-2025-30779 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-30779

Vulnerability Analysis

The vulnerability is a stored XSS flaw in the Doneren met Mollie plugin. The plugin fails to sanitize or escape user-controlled input before rendering it in web pages generated by WordPress. An attacker submits crafted input containing JavaScript payloads through an input field that the plugin persists to the database. When a legitimate user, including an administrator, later loads a page that reflects this stored data, the browser parses and executes the injected script in the context of the site's origin.

Exploitation requires an account with at least low-level privileges and depends on a victim viewing the tainted page. The impact extends beyond the plugin itself because the scope change allows scripts to interact with the broader WordPress environment, including session cookies, administrative interfaces, and other plugins.

Root Cause

The root cause is missing or insufficient output encoding when the plugin renders donation-related data supplied by users. WordPress provides sanitization APIs such as esc_html(), esc_attr(), and wp_kses() that must be applied consistently to any input reflected in HTML. The plugin's failure to apply these functions to stored data allows raw HTML and script tags to reach the DOM intact.

Attack Vector

The attack is delivered over the network through the plugin's input fields. An authenticated attacker submits a payload containing HTML or JavaScript. The payload is persisted server-side and executed when any user, including higher-privileged administrators, loads the affected page. Because scope changes, the injected script can act on the entire site origin, not only on the vulnerable plugin's surface.

Refer to the Patchstack Vulnerability Report for additional technical context.

Detection Methods for CVE-2025-30779

Indicators of Compromise

Unexpected <script>, <iframe>, or event handler attributes (such as onerror, onload) stored in donation-related database tables or plugin options.
WordPress user accounts created without administrator initiation, or sudden privilege changes following visits to donation pages.
Outbound HTTP requests from browser sessions to unfamiliar domains after loading pages rendered by the Doneren met Mollie plugin.

Detection Strategies

Query the WordPress wp_options and plugin-specific tables for entries containing HTML tags or JavaScript keywords such as script, javascript:, or onerror=.
Review web server access logs for POST requests to Doneren met Mollie endpoints containing URL-encoded HTML payloads.
Deploy a Content Security Policy (CSP) in report-only mode to surface unexpected inline script execution originating from plugin-rendered pages.

Monitoring Recommendations

Monitor administrator sessions for anomalous XHR or fetch traffic initiated after accessing donation management pages.
Track plugin file integrity and configuration changes through a file integrity monitoring tool.
Alert on new WordPress users, role changes, or REST API activity that follows access to plugin-controlled URLs.

How to Mitigate CVE-2025-30779

Immediate Actions Required

Identify all WordPress sites running the Doneren met Mollie plugin at version 2.10.7 or earlier and prioritize remediation.
Restrict plugin administrative access to trusted accounts and enforce multi-factor authentication for WordPress user accounts with contributor privileges or higher.
Audit stored plugin data for existing script payloads and remove any malicious entries before restoring public access.

Patch Information

No fixed version is identified in the available advisory data at the time of publication. Site operators should consult the Patchstack Vulnerability Report and the plugin's official channels for updated releases addressing this issue.

Workarounds

Deactivate the Doneren met Mollie plugin until a patched version is available and verified.
Deploy a Web Application Firewall (WAF) rule to block requests containing HTML or JavaScript payloads targeting plugin endpoints.
Enforce a strict Content Security Policy that disallows inline scripts (script-src 'self') to limit execution of injected payloads.

bash

# Example CSP header for Nginx to mitigate stored XSS execution
add_header Content-Security-Policy "default-src 'self'; script-src 'self'; object-src 'none'; frame-ancestors 'self'; base-uri 'self'" always;