CVE-2025-30995: Widgetize Pages Light CSRF Vulnerability

CVE-2025-30995 Overview

CVE-2025-30995 is a Cross-Site Request Forgery (CSRF) vulnerability in the OTWthemes Widgetize Pages Light WordPress plugin. The flaw affects all versions up to and including 3.0 of the widgetize-pages-light plugin. Successful exploitation chains CSRF with Stored Cross-Site Scripting (XSS), allowing attackers to persist malicious JavaScript in the WordPress site through forged administrator requests. The vulnerability maps to CWE-352: Cross-Site Request Forgery and requires user interaction from a privileged victim to trigger the malicious request.

Critical Impact

An unauthenticated attacker can trick an authenticated WordPress administrator into submitting a forged request that injects persistent JavaScript into the site, leading to session theft, account takeover, or visitor redirection.

Affected Products

• OTWthemes Widgetize Pages Light WordPress plugin (widgetize-pages-light)
• All versions from n/a through 3.0
• WordPress sites with the affected plugin installed and activated

Discovery Timeline

• 2025-06-06 - CVE-2025-30995 published to NVD
• 2026-04-23 - Last updated in NVD database

Technical Details for CVE-2025-30995

Vulnerability Analysis

The Widgetize Pages Light plugin fails to validate the origin and intent of state-changing HTTP requests sent to its administrative endpoints. The plugin does not implement WordPress nonce verification using wp_verify_nonce() or check_admin_referer() on form submissions that modify widget content. Attackers exploit this gap by crafting a malicious page that auto-submits a forged request when an authenticated administrator visits it.

Because the plugin also fails to sanitize widget input before storing it, the forged request persists attacker-controlled JavaScript in the WordPress database. The payload executes whenever an administrator or visitor renders the affected widget page. This combination converts a client-side trust flaw into a stored XSS condition with a broad blast radius.

The vulnerability requires user interaction, meaning the targeted administrator must visit an attacker-controlled page while authenticated to the WordPress dashboard.

Root Cause

The root cause is the absence of anti-CSRF tokens on plugin endpoints that accept widget configuration data. WordPress provides the nonce API specifically to prevent this class of attack, but the plugin code does not invoke it. A secondary defect — missing output encoding and input sanitization on widget fields — enables the stored XSS payload to render unescaped in administrative and public contexts.

Attack Vector

The attack proceeds in three stages. First, an attacker hosts a malicious HTML page containing a hidden form or fetch() call targeting the vulnerable Widgetize Pages Light admin endpoint. Second, the attacker lures an authenticated WordPress administrator to the page through phishing, malvertising, or a compromised third-party site. Third, the browser submits the forged request using the administrator's active session cookies, writing the XSS payload into the widget store.

The vulnerability mechanism is documented in the Patchstack WordPress Vulnerability Report. No public proof-of-concept exploit is available, and EPSS scoring places the probability of exploitation at the lower end of the scale.

Detection Methods for CVE-2025-30995

Indicators of Compromise

• Unexpected <script> tags, event handlers (onerror, onload), or obfuscated JavaScript within WordPress widget content stored in the wp_options or widget-related database tables
• HTTP POST requests to Widgetize Pages Light admin endpoints with Referer headers pointing to external or unknown domains
• New or modified WordPress administrator accounts created shortly after an admin session visited an external link
• Outbound browser traffic from admin sessions to attacker-controlled domains hosting credential collectors

Detection Strategies

• Inspect widget configuration entries in the WordPress database for HTML or JavaScript content that should not appear in widget fields
• Review web server access logs for state-changing requests to plugin endpoints that lack a same-origin Referer header
• Monitor WordPress audit logs for widget modifications correlated with administrator browsing activity to external sites
• Deploy a Web Application Firewall (WAF) rule that flags POST requests to widgetize-pages-light paths without valid nonce parameters

Monitoring Recommendations

• Enable WordPress activity logging plugins to capture all widget and option changes with user attribution and source IP
• Forward WordPress and web server logs to a centralized SIEM for correlation across administrator sessions
• Alert on anomalous administrator session activity originating from unusual geographies or user agents

How to Mitigate CVE-2025-30995

Immediate Actions Required

• Deactivate and remove the Widgetize Pages Light plugin until a patched version is released, since no fixed version is currently identified in the advisory
• Audit all existing widget content for injected scripts and remove malicious payloads from the database
• Force a password reset for all WordPress administrator accounts and invalidate active sessions
• Apply a WAF rule that blocks cross-origin POST requests to WordPress admin endpoints

Patch Information

The vendor advisory tracked by Patchstack lists the vulnerability as affecting versions up to and including 3.0, with no patched release identified at the time of disclosure. Site operators should monitor the Patchstack advisory and the WordPress plugin repository for updates. Replace the plugin with a maintained alternative if a fix is not published.

Workarounds

• Restrict access to /wp-admin/ by IP allowlist at the web server or reverse proxy layer to reduce CSRF exposure
• Enforce administrator sessions through a separate browser profile that does not browse the public internet
• Configure the SameSite=Strict attribute on WordPress session cookies to block cross-site cookie transmission
• Deploy a Content Security Policy (CSP) that restricts inline script execution to mitigate the stored XSS impact

# Nginx configuration example to restrict wp-admin by IP
location ^~ /wp-admin/ {
    allow 203.0.113.0/24;
    deny all;
    try_files $uri $uri/ /index.php?$args;
}

# Add SameSite and security headers
add_header Set-Cookie "Path=/; HttpOnly; Secure; SameSite=Strict";
add_header Content-Security-Policy "default-src 'self'; script-src 'self'";