CVE-2025-30984 Overview
CVE-2025-30984 is a Reflected Cross-Site Scripting (XSS) vulnerability in the Dzynit seo-automatic-seo-tools WordPress plugin. The flaw affects all SEO Tools plugin versions up to and including 4.0.7. An attacker can craft a malicious URL that, when visited by a victim, executes arbitrary JavaScript in the victim's browser session. The vulnerability is tracked under [CWE-79] and stems from improper neutralization of user-supplied input during web page generation.
Critical Impact
Successful exploitation allows attackers to execute arbitrary JavaScript in a victim's browser, enabling session theft, credential harvesting, and unauthorized actions performed under the victim's WordPress identity.
Affected Products
- Dzynit SEO Tools (seo-automatic-seo-tools) WordPress plugin
- All versions from initial release through 4.0.7
- WordPress sites running the vulnerable plugin in any deployment configuration
Discovery Timeline
- 2025-04-15 - CVE-2025-30984 published to NVD
- 2026-04-23 - Last updated in NVD database
Technical Details for CVE-2025-30984
Vulnerability Analysis
The vulnerability is a Reflected Cross-Site Scripting (XSS) flaw classified under [CWE-79]. The plugin accepts user-controlled input through HTTP request parameters and reflects that input back into the rendered HTML response without proper output encoding or sanitization. Because the malicious payload is echoed directly into the page, the victim's browser executes it as legitimate script content.
The attack requires user interaction, typically through a crafted link delivered by phishing or embedded on an attacker-controlled site. The scope is changed, meaning the executed script can affect resources beyond the vulnerable component, including session cookies and DOM elements outside the plugin's context. The EPSS score is 0.437% at the 63rd percentile.
Root Cause
The root cause is improper neutralization of input during web page generation. The plugin fails to apply WordPress sanitization helpers such as esc_html(), esc_attr(), or wp_kses() before rendering request parameters back into the response. Any string containing HTML or JavaScript metacharacters reaches the browser intact and is parsed as executable markup.
Attack Vector
The attack vector is network-based and requires no authentication. An attacker constructs a URL targeting a vulnerable endpoint of the SEO Tools plugin and embeds a JavaScript payload in a reflected parameter. When an authenticated administrator or any authenticated user clicks the link, the script executes with the privileges of the victim's WordPress session. Attackers commonly use this primitive to steal wordpress_logged_in cookies, inject backdoor administrator accounts, or pivot to stored XSS.
The vulnerability is reflected rather than stored, so each exploitation requires fresh user interaction. See the Patchstack WordPress Vulnerability advisory for technical details.
Detection Methods for CVE-2025-30984
Indicators of Compromise
- HTTP requests to WordPress endpoints containing URL-encoded <script>, onerror=, onload=, or javascript: payloads in query parameters
- Unexpected outbound requests from administrator browser sessions to unfamiliar domains shortly after clicking external links
- Newly created WordPress administrator accounts or modified user roles without corresponding admin activity
- Referrer headers pointing to external phishing or attacker-controlled domains preceding WordPress admin actions
Detection Strategies
- Inspect web server access logs for requests to seo-automatic-seo-tools plugin paths containing reflective payloads or HTML entities in parameters
- Deploy a Web Application Firewall (WAF) rule set with OWASP CRS XSS signatures enabled in blocking mode
- Monitor WordPress audit logs for anomalous administrator session activity correlated with suspicious inbound traffic
Monitoring Recommendations
- Enable Content Security Policy (CSP) reporting to capture inline script execution attempts on WordPress administrative pages
- Alert on WordPress user role changes, plugin installs, and option modifications outside scheduled maintenance windows
- Forward webserver and WordPress logs to a centralized SIEM for correlation against known XSS payload patterns
How to Mitigate CVE-2025-30984
Immediate Actions Required
- Disable the Dzynit SEO Tools plugin until a patched version is available and verified
- Audit WordPress administrator accounts and rotate session cookies, passwords, and application keys for any users who may have interacted with crafted links
- Apply WAF rules to block requests containing XSS payloads targeting the plugin's endpoints
Patch Information
At the time of publication, the advisory lists affected versions through 4.0.7 with no fixed version explicitly identified in the NVD record. Administrators should consult the Patchstack WordPress Vulnerability advisory and the WordPress.org plugin repository for current patch availability and update to the latest released version immediately upon release.
Workarounds
- Remove or deactivate the seo-automatic-seo-tools plugin from the WordPress site until a fixed release is confirmed
- Restrict access to /wp-admin/ by IP allowlist to limit exposure of authenticated administrators to phishing links
- Enforce a strict Content Security Policy that disallows inline scripts and untrusted script sources on WordPress pages
- Train administrators to avoid clicking unsolicited links pointing to their own WordPress installation
# Disable the vulnerable plugin via WP-CLI
wp plugin deactivate seo-automatic-seo-tools
wp plugin delete seo-automatic-seo-tools
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
