Skip to main content

Contact Form 7 Material Design CVE-2025-30522

HIGH
Cross-Site Request Forgery (CSRF) (CWE-352)
2025-03-24 audit@patchstack.com
7.1
CVSS 3.1 · NVD
Share

Severity by source

NVD PRIMARY
7.1 HIGH
AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L
Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
Required
Scope
Changed
Confidentiality
Low
Integrity
Low
Availability
Low

Lifecycle Timeline

4
Analysis Updated
Apr 25, 2026 - 00:21 vuln.today
v2 (cvss_changed)
Re-analysis Queued
Apr 23, 2026 - 15:42 vuln.today
cvss_changed
Analysis Generated
Mar 28, 2026 - 18:33 vuln.today
CVE Published
Mar 24, 2025 - 14:15 nvd
HIGH 7.1

DescriptionCVE.org

Cross-Site Request Forgery (CSRF) vulnerability in Damian Orzol Contact Form 7 Material Design allows Stored XSS. This issue affects Contact Form 7 Material Design: from n/a through 1.0.0.

AnalysisAI

Cross-Site Request Forgery in Contact Form 7 Material Design plugin versions up to 1.0.0 allows attackers to trick authenticated administrators into executing malicious requests that inject persistent JavaScript, achieving Stored XSS. CVSS 7.1 reflects the changed scope (S:C) and multi-stage attack requiring user interaction. EPSS score of 0.08% (24th percentile) indicates low probability of mass exploitation, with no evidence of active exploitation (not in CISA KEV) or public POC at time of analysis. This CSRF-to-XSS chain targets WordPress site administrators.

Technical ContextAI

This vulnerability chains two CWE classes: CWE-352 (Cross-Site Request Forgery) as the initial vector enabling CWE-79 (Stored Cross-Site Scripting) as the consequence. Contact Form 7 Material Design is a WordPress plugin that provides Material Design styling for Contact Form 7 forms. The CSRF weakness allows attackers to forge requests on behalf of authenticated administrators, bypassing the plugin's lack of proper nonce validation or anti-CSRF tokens. When an admin is tricked into visiting a malicious site or clicking a crafted link while authenticated, the forged request injects malicious JavaScript that persists in the WordPress database, creating a stored XSS condition that executes whenever any user views the affected form or plugin settings page. The changed scope (S:C) in the CVSS vector indicates the vulnerability can affect resources beyond the vulnerable component itself, typical of XSS that executes in victim browsers.

Affected ProductsAI

WordPress plugin Contact Form 7 Material Design versions from initial release through 1.0.0 are affected. Vendor is Damian Orzol. The vulnerability database entry is documented at Patchstack with references https://patchstack.com/database/wordpress/plugin/cf7-material-design/vulnerability/wordpress-contact-form-7-material-design-plugin-1-0-0-csrf-to-stored-xss-vulnerability. No CPE data available in NVD at time of analysis, suggesting this is a recently disclosed vulnerability pending full NVD enrichment.

RemediationAI

Upstream fix available; released patched version not independently confirmed from available data. Check the WordPress plugin repository or contact plugin author Damian Orzol for versions newer than 1.0.0 that address CVE-2025-30522. Until a confirmed patch is applied, implement compensating controls: (1) Restrict WordPress admin access to trusted IP ranges via .htaccess or firewall rules, reducing CSRF attack surface but limiting remote administration; (2) Install a Web Application Firewall with CSRF token validation for WordPress admin endpoints, though this may cause false positives with legitimate admin workflows; (3) Educate administrators to avoid clicking external links while logged into WordPress and to use separate browser profiles for admin access versus general browsing; (4) If Material Design styling is non-critical, deactivate and remove the plugin entirely until a security-reviewed version is available. Monitor Patchstack advisory at https://patchstack.com/database/wordpress/plugin/cf7-material-design/ for official patch announcements. After patching, review WordPress database tables for injected script tags in form configurations or plugin settings from the stored XSS component.

Share

CVE-2025-30522 vulnerability details – vuln.today

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy