CVE-2025-30919: Store Locator Widget CSRF Vulnerability

CVE-2025-30919 Overview

CVE-2025-30919 is a Cross-Site Request Forgery (CSRF) vulnerability in the Store Locator Widget WordPress plugin that enables attackers to chain the CSRF flaw with Stored Cross-Site Scripting (XSS). This chained vulnerability allows malicious actors to trick authenticated administrators into performing unintended actions that result in persistent XSS payloads being stored within the WordPress site.

Critical Impact

Attackers can leverage CSRF to inject malicious scripts that persist on the site, potentially compromising administrative accounts, stealing session cookies, redirecting users to malicious sites, or defacing the website.

Affected Products

• Store Locator Widget WordPress Plugin version 2025r2 and earlier
• All WordPress installations running vulnerable versions of the Store Locator Widget plugin
• WordPress sites with administrative users who may interact with malicious links

Discovery Timeline

• 2025-03-27 - CVE CVE-2025-30919 published to NVD
• 2026-04-15 - Last updated in NVD database

Technical Details for CVE-2025-30919

Vulnerability Analysis

This vulnerability represents a classic CSRF-to-Stored-XSS attack chain affecting the Store Locator Widget plugin for WordPress. The plugin fails to properly validate request origins through anti-CSRF tokens (nonces) in administrative functionality, allowing attackers to craft malicious requests that authenticated administrators unknowingly execute.

When combined with insufficient output encoding in plugin settings or content areas, the CSRF vulnerability enables attackers to inject JavaScript code that gets stored in the database and subsequently rendered to all site visitors. This type of chained vulnerability is particularly dangerous because it converts what would otherwise be a transient attack into a persistent threat affecting all users who view the compromised pages.

The vulnerability is classified under CWE-352 (Cross-Site Request Forgery), which describes scenarios where web applications do not sufficiently verify whether legitimate requests were intentionally submitted by the user who submitted them.

Root Cause

The root cause stems from two interconnected security weaknesses in the Store Locator Widget plugin:

1. Missing CSRF Protection: Administrative forms or AJAX endpoints lack proper WordPress nonce verification using functions like wp_verify_nonce() or check_admin_referer(). This allows external sites to forge requests that appear legitimate to the WordPress backend.

2. Insufficient Input Sanitization: User-supplied input that passes through the CSRF-vulnerable endpoint is not properly sanitized before storage, and output encoding is missing when rendering stored content, enabling the persistence and execution of malicious scripts.

Attack Vector

The attack unfolds through a social engineering component combined with technical exploitation:

1. The attacker identifies CSRF-vulnerable administrative functionality in the Store Locator Widget plugin that accepts user input for storage
2. The attacker crafts a malicious HTML page containing a hidden form or JavaScript-triggered request that submits XSS payload to the vulnerable endpoint
3. The attacker tricks an authenticated WordPress administrator into visiting the malicious page (via phishing email, forum post, or other means)
4. The administrator's browser automatically sends the forged request with their session cookies, causing the XSS payload to be stored
5. The malicious script executes whenever any user views the affected page, potentially stealing credentials, session tokens, or performing unauthorized actions

The attack requires no authentication from the attacker's perspective and leverages the victim administrator's session privileges to accomplish the injection.

Detection Methods for CVE-2025-30919

Indicators of Compromise

• Unexpected JavaScript code in Store Locator Widget settings or database entries
• Suspicious <script> tags, onerror handlers, or event-based JavaScript in locator-related content
• Admin users reporting unexpected redirects or browser behavior when managing store locations
• Web application firewall logs showing blocked XSS payloads targeting plugin endpoints

Detection Strategies

• Enable WordPress audit logging to track changes to plugin settings and database modifications
• Implement Web Application Firewall (WAF) rules to detect and block CSRF and XSS attack patterns
• Monitor for outbound connections to unfamiliar domains that may indicate data exfiltration from XSS payloads
• Review HTTP referrer headers in access logs for administrative endpoints to identify external request origins

Monitoring Recommendations

• Configure real-time alerts for modifications to Store Locator Widget configuration data
• Deploy browser-based Content Security Policy (CSP) headers to mitigate XSS execution
• Regularly scan stored content and database fields associated with the plugin for malicious scripts
• Monitor for anomalous administrative session activity that could indicate session hijacking via XSS

How to Mitigate CVE-2025-30919

Immediate Actions Required

• Update the Store Locator Widget plugin to the latest available version that addresses this vulnerability
• Audit existing Store Locator Widget settings and database entries for evidence of injected malicious content
• Implement Content Security Policy headers to reduce XSS impact if exploitation has occurred
• Educate administrative users about phishing risks and the importance of not clicking untrusted links while logged into WordPress

Patch Information

Refer to the Patchstack Vulnerability Report for detailed patch information and remediation guidance. Users should update the Store Locator Widget plugin to a version newer than 2025r2 once available from the plugin vendor.

Workarounds

• Temporarily deactivate the Store Locator Widget plugin if an immediate update is not available
• Restrict administrative access to trusted IP addresses to limit CSRF exploitation opportunities
• Implement a Web Application Firewall with rules to block cross-origin form submissions to WordPress admin endpoints
• Consider using browser extensions that provide CSRF protection for administrative sessions