CVE-2025-30995: Widgetize Pages Light CSRF Vulnerability

CVE-2025-30995 Overview

CVE-2025-30995 is a Cross-Site Request Forgery (CSRF) vulnerability in the OTWthemes Widgetize Pages Light WordPress plugin. The flaw affects all plugin versions up to and including 3.0. An attacker can chain CSRF with stored Cross-Site Scripting (XSS) to persist malicious JavaScript in the WordPress site. Exploitation requires tricking an authenticated administrator into visiting a crafted page or clicking a malicious link. The injected script then executes in the browser context of any visitor or administrator who loads the affected page.

Critical Impact

Successful exploitation allows attackers to persist arbitrary JavaScript in WordPress pages, enabling session hijacking, administrator account compromise, and site defacement.

Affected Products

• OTWthemes Widgetize Pages Light plugin for WordPress
• All versions from n/a through 3.0
• WordPress sites with the widgetize-pages-light plugin enabled

Discovery Timeline

• 2025-06-06 - CVE-2025-30995 published to NVD
• 2026-04-23 - Last updated in NVD database

Technical Details for CVE-2025-30995

Vulnerability Analysis

The vulnerability combines two distinct weaknesses in the Widgetize Pages Light plugin. The plugin's state-changing requests lack proper anti-CSRF token validation, classified under [CWE-352]. State-changing handlers also fail to sanitize or escape user-supplied input before storing it, enabling stored XSS. An attacker hosts a malicious page containing a forged form or JavaScript that submits a request to a vulnerable plugin endpoint. When an authenticated WordPress administrator visits that page, their browser submits the request with valid session cookies. The plugin processes the request as legitimate and stores attacker-controlled markup. The injected payload executes whenever a victim loads the affected widget or page.

Root Cause

The root cause is the absence of WordPress nonce verification through functions such as wp_verify_nonce() or check_admin_referer() on privileged actions. The plugin additionally omits output escaping with functions like esc_html() or esc_attr() for stored widget content.

Attack Vector

Exploitation requires user interaction from a privileged account. An attacker lures an authenticated administrator to a malicious URL or page. The forged request mutates widget content on the WordPress site without consent. The persistent payload then runs in every subsequent visitor's browser session, including other administrators.

No verified public exploit code is available. See the Patchstack WordPress Vulnerability Report for advisory details.

Detection Methods for CVE-2025-30995

Indicators of Compromise

• Unexpected <script> tags, event handlers, or obfuscated JavaScript stored in widget configurations or page content managed by Widgetize Pages Light.
• WordPress admin POST requests originating from external Referer headers targeting plugin endpoints under /wp-admin/ related to widgetize-pages-light.
• New or modified administrator accounts created shortly after suspicious widget edits.

Detection Strategies

• Audit the WordPress database, particularly wp_options and wp_posts rows associated with the plugin, for HTML or JavaScript that does not match legitimate widget content.
• Inspect web server access logs for POST requests to plugin admin handlers with off-site Referer values, indicating possible CSRF abuse.
• Use WordPress security plugins or file integrity monitoring to flag unexpected changes to widget data and plugin files.

Monitoring Recommendations

• Enable verbose logging on the WordPress admin interface and forward events to a centralized logging platform for correlation.
• Monitor browser-side errors and Content Security Policy (CSP) violation reports that may indicate stored XSS execution.
• Alert on outbound traffic from administrator browsers to unknown domains shortly after admin sessions begin.

How to Mitigate CVE-2025-30995

Immediate Actions Required

• Deactivate and remove the Widgetize Pages Light plugin until a patched release is published by the vendor.
• Rotate all WordPress administrator passwords and invalidate active sessions after confirming no stored payloads remain.
• Review widget content, posts, and plugin options for injected scripts and remove any unauthorized markup.

Patch Information

At the time of publication, no fixed version is identified beyond 3.0. Monitor the Patchstack advisory and the official plugin repository for an updated release.

Workarounds

• Restrict access to /wp-admin/ by IP allowlist through web server configuration or a Web Application Firewall (WAF).
• Deploy a WAF rule that enforces a same-origin Referer or Origin header on plugin admin POST requests.
• Apply a strict Content Security Policy that disallows inline scripts to limit the impact of stored XSS payloads.

# Example nginx rule to block off-origin POSTs to wp-admin
location ~ ^/wp-admin/ {
    if ($request_method = POST) {
        set $block 1;
    }
    if ($http_referer ~* "^https?://yourdomain\.com/") {
        set $block 0;
    }
    if ($block = 1) {
        return 403;
    }
}