CVE-2025-30991: WPDM Premium Packages Stored XSS Vulnerability

CVE-2025-30991 Overview

CVE-2025-30991 is a stored cross-site scripting (XSS) vulnerability in the WPDM Premium Packages WordPress plugin developed by Shahjada. The flaw affects all versions up to and including 6.0.6. Attackers with low-privileged authenticated access can inject persistent malicious scripts that execute in the browser context of any user who views the affected page. The vulnerability is classified under [CWE-79] for improper neutralization of input during web page generation. Successful exploitation can lead to session token theft, unauthorized administrative actions, and content manipulation across the WordPress site.

Critical Impact
Authenticated attackers can inject persistent JavaScript payloads that execute against site visitors and administrators, enabling account takeover and site defacement.

Affected Products

Shahjada WPDM – Premium Packages plugin for WordPress
All versions from initial release through 6.0.6
WordPress sites with the wpdm-premium-packages extension installed

Discovery Timeline

2025-06-06 - CVE-2025-30991 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-30991

Vulnerability Analysis

The vulnerability stems from improper input sanitization within the WPDM Premium Packages plugin. User-supplied data is stored in the database and later rendered in web pages without adequate encoding or filtering. This creates a stored XSS condition where injected scripts persist across sessions and execute for every user who loads the affected content.

Exploitation requires low-level authentication and user interaction. The scope is changed, meaning the vulnerable component can affect resources beyond its security authority. This typically indicates the payload can escape the plugin context and affect broader WordPress administrative interfaces.

Root Cause

The root cause is missing output encoding when the plugin renders user-controlled input in HTML contexts. Input accepted through plugin fields is not passed through WordPress sanitization functions such as esc_html(), esc_attr(), or wp_kses() before being written to the page. When the stored data is subsequently displayed, the browser interprets injected <script> tags or event handler attributes as executable code.

Attack Vector

An authenticated attacker with contributor-level or higher privileges submits a crafted payload through a plugin input field that persists to the database. When an administrator or site visitor loads the page containing the stored payload, the injected JavaScript executes in their browser session. Attack outcomes include stealing authentication cookies, performing actions on behalf of the victim, redirecting to phishing pages, or dropping additional malicious content.

Refer to the Patchstack Security Advisory for additional technical context.

Detection Methods for CVE-2025-30991

Indicators of Compromise

Unexpected <script> tags, javascript: URIs, or DOM event handler attributes (onerror, onload, onclick) stored in WordPress post metadata or plugin-specific database tables
Outbound HTTP requests from browser sessions to unfamiliar domains after loading WPDM package pages
New or modified administrator accounts created shortly after WPDM package pages were accessed
Anomalous browser console errors or content security policy violations on pages rendered by the plugin

Detection Strategies

Query the WordPress database for plugin-related tables and search for HTML tags or JavaScript keywords in fields that should contain plain text
Enable Content Security Policy (CSP) reporting to identify inline script execution attempts on plugin-generated pages
Review web server access logs for POST requests to WPDM plugin endpoints paired with payloads containing script markup
Monitor WordPress audit logs for unusual content edits by contributor or author accounts

Monitoring Recommendations

Alert on database writes to WPDM tables that contain HTML entities encoded as script tags or event handlers
Track authentication cookie access patterns from browsers loading WPDM-rendered pages
Correlate plugin update status across managed WordPress instances to prioritize unpatched sites
Use file integrity monitoring on plugin directories to identify tampering or backdoored versions

How to Mitigate CVE-2025-30991

Immediate Actions Required

Identify all WordPress installations running WPDM Premium Packages version 6.0.6 or earlier
Upgrade the plugin to a fixed release as published by the vendor as soon as available
Audit contributor, author, and editor accounts and rotate credentials for any accounts with unexpected activity
Review and clean stored plugin content for malicious script payloads

Patch Information

According to the Patchstack Security Advisory, the vulnerability affects WPDM Premium Packages versions through 6.0.6. Site administrators should apply the latest available plugin update from the vendor and confirm the installed version is beyond the vulnerable range.

Workarounds

Temporarily deactivate the WPDM Premium Packages plugin until a patched version can be deployed
Restrict contributor and author role assignments to trusted users only
Deploy a web application firewall (WAF) rule set that filters XSS payloads targeting wpdm-premium-packages endpoints
Enforce a strict Content Security Policy that disallows inline scripts on WordPress pages

bash

# Example CSP header to reduce XSS execution risk
Header set Content-Security-Policy "default-src 'self'; script-src 'self'; object-src 'none'; base-uri 'self'"