What is the CVSS score of CVE-2025-30522?

CVE-2025-30522 has a CVSS 3.1 base score of 7.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L. EPSS exploitation probability: 0.1%.

Which versions of Contact Form 7 Material Design are affected by CVE-2025-30522?

Contact Form 7 Material Design plugin versions up to 1.0.0 contain a cross-site request forgery vulnerability that allows attackers to inject persistent JavaScript into WordPress sites when…

How to fix or mitigate CVE-2025-30522?

Within 24 hours: Audit all WordPress installations for Contact Form 7 Material Design plugin presence and current version. Within 7 days: Disable or uninstall the plugin on all affected systems if version 1.0.0 or earlier is detected; if the plugin is critical, implement the compensating controls below immediately. Within 30 days: Monitor vendor repository for patch release; once available, apply the patched version across all instances.

Contact Form 7 Material Design CVE-2025-30522

HIGH

Cross-Site Request Forgery (CSRF) (CWE-352)

2025-03-24 audit@patchstack.com

WordPress XSS CSRF Wordpress Plugin

7.1

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.1 HIGH

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

Low

Lifecycle Timeline

Analysis Updated

Apr 25, 2026 - 00:21 vuln.today

v2 (cvss_changed)

Re-analysis Queued

Apr 23, 2026 - 15:42 vuln.today

cvss_changed

Analysis Generated

Mar 28, 2026 - 18:33 vuln.today

CVE Published

Mar 24, 2025 - 14:15 nvd

HIGH 7.1

DescriptionCVE.org

Cross-Site Request Forgery (CSRF) vulnerability in Damian Orzol Contact Form 7 Material Design allows Stored XSS. This issue affects Contact Form 7 Material Design: from n/a through 1.0.0.

AnalysisAI

Cross-Site Request Forgery in Contact Form 7 Material Design plugin versions up to 1.0.0 allows attackers to trick authenticated administrators into executing malicious requests that inject persistent JavaScript, achieving Stored XSS. CVSS 7.1 reflects the changed scope (S:C) and multi-stage attack requiring user interaction. EPSS score of 0.08% (24th percentile) indicates low probability of mass exploitation, with no evidence of active exploitation (not in CISA KEV) or public POC at time of analysis. This CSRF-to-XSS chain targets WordPress site administrators.

Technical ContextAI

This vulnerability chains two CWE classes: CWE-352 (Cross-Site Request Forgery) as the initial vector enabling CWE-79 (Stored Cross-Site Scripting) as the consequence. Contact Form 7 Material Design is a WordPress plugin that provides Material Design styling for Contact Form 7 forms. The CSRF weakness allows attackers to forge requests on behalf of authenticated administrators, bypassing the plugin's lack of proper nonce validation or anti-CSRF tokens. When an admin is tricked into visiting a malicious site or clicking a crafted link while authenticated, the forged request injects malicious JavaScript that persists in the WordPress database, creating a stored XSS condition that executes whenever any user views the affected form or plugin settings page. The changed scope (S:C) in the CVSS vector indicates the vulnerability can affect resources beyond the vulnerable component itself, typical of XSS that executes in victim browsers.

Affected ProductsAI

WordPress plugin Contact Form 7 Material Design versions from initial release through 1.0.0 are affected. Vendor is Damian Orzol. The vulnerability database entry is documented at Patchstack with references https://patchstack.com/database/wordpress/plugin/cf7-material-design/vulnerability/wordpress-contact-form-7-material-design-plugin-1-0-0-csrf-to-stored-xss-vulnerability. No CPE data available in NVD at time of analysis, suggesting this is a recently disclosed vulnerability pending full NVD enrichment.

RemediationAI

Upstream fix available; released patched version not independently confirmed from available data. Check the WordPress plugin repository or contact plugin author Damian Orzol for versions newer than 1.0.0 that address CVE-2025-30522. Until a confirmed patch is applied, implement compensating controls: (1) Restrict WordPress admin access to trusted IP ranges via .htaccess or firewall rules, reducing CSRF attack surface but limiting remote administration; (2) Install a Web Application Firewall with CSRF token validation for WordPress admin endpoints, though this may cause false positives with legitimate admin workflows; (3) Educate administrators to avoid clicking external links while logged into WordPress and to use separate browser profiles for admin access versus general browsing; (4) If Material Design styling is non-critical, deactivate and remove the plugin entirely until a security-reviewed version is available. Monitor Patchstack advisory at https://patchstack.com/database/wordpress/plugin/cf7-material-design/ for official patch announcements. After patching, review WordPress database tables for injected script tags in form configurations or plugin settings from the stored XSS component.