Contact Form 7 Material Design CVE-2025-30522
HIGHSeverity by source
AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L
Lifecycle Timeline
4DescriptionCVE.org
Cross-Site Request Forgery (CSRF) vulnerability in Damian Orzol Contact Form 7 Material Design allows Stored XSS. This issue affects Contact Form 7 Material Design: from n/a through 1.0.0.
AnalysisAI
Cross-Site Request Forgery in Contact Form 7 Material Design plugin versions up to 1.0.0 allows attackers to trick authenticated administrators into executing malicious requests that inject persistent JavaScript, achieving Stored XSS. CVSS 7.1 reflects the changed scope (S:C) and multi-stage attack requiring user interaction. EPSS score of 0.08% (24th percentile) indicates low probability of mass exploitation, with no evidence of active exploitation (not in CISA KEV) or public POC at time of analysis. This CSRF-to-XSS chain targets WordPress site administrators.
Technical ContextAI
This vulnerability chains two CWE classes: CWE-352 (Cross-Site Request Forgery) as the initial vector enabling CWE-79 (Stored Cross-Site Scripting) as the consequence. Contact Form 7 Material Design is a WordPress plugin that provides Material Design styling for Contact Form 7 forms. The CSRF weakness allows attackers to forge requests on behalf of authenticated administrators, bypassing the plugin's lack of proper nonce validation or anti-CSRF tokens. When an admin is tricked into visiting a malicious site or clicking a crafted link while authenticated, the forged request injects malicious JavaScript that persists in the WordPress database, creating a stored XSS condition that executes whenever any user views the affected form or plugin settings page. The changed scope (S:C) in the CVSS vector indicates the vulnerability can affect resources beyond the vulnerable component itself, typical of XSS that executes in victim browsers.
Affected ProductsAI
WordPress plugin Contact Form 7 Material Design versions from initial release through 1.0.0 are affected. Vendor is Damian Orzol. The vulnerability database entry is documented at Patchstack with references https://patchstack.com/database/wordpress/plugin/cf7-material-design/vulnerability/wordpress-contact-form-7-material-design-plugin-1-0-0-csrf-to-stored-xss-vulnerability. No CPE data available in NVD at time of analysis, suggesting this is a recently disclosed vulnerability pending full NVD enrichment.
RemediationAI
Upstream fix available; released patched version not independently confirmed from available data. Check the WordPress plugin repository or contact plugin author Damian Orzol for versions newer than 1.0.0 that address CVE-2025-30522. Until a confirmed patch is applied, implement compensating controls: (1) Restrict WordPress admin access to trusted IP ranges via .htaccess or firewall rules, reducing CSRF attack surface but limiting remote administration; (2) Install a Web Application Firewall with CSRF token validation for WordPress admin endpoints, though this may cause false positives with legitimate admin workflows; (3) Educate administrators to avoid clicking external links while logged into WordPress and to use separate browser profiles for admin access versus general browsing; (4) If Material Design styling is non-critical, deactivate and remove the plugin entirely until a security-reviewed version is available. Monitor Patchstack advisory at https://patchstack.com/database/wordpress/plugin/cf7-material-design/ for official patch announcements. After patching, review WordPress database tables for injected script tags in form configurations or plugin settings from the stored XSS component.
Same weakness CWE-352 – Cross-Site Request Forgery (CSRF)
View allShare
External POC / Exploit Code
Leaving vuln.today