What is the CVSS score of CVE-2025-30552?

CVE-2025-30552 has a CVSS 3.1 base score of 7.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L. EPSS exploitation probability: 0.1%.

Which versions of WordPress Admin Bar Improved are affected by CVE-2025-30552?

CVE-2025-30552 affects WordPress Admin Bar Improved plugin versions up to 3.3.5, enabling attackers to inject persistent malicious scripts into the WordPress admin interface through a CSRF+XSS attack…

How to fix or mitigate CVE-2025-30552?

Within 24 hours: Identify all WordPress instances using Admin Bar Improved plugin and document current versions via plugin audit. Within 7 days: Deactivate Admin Bar Improved plugin version 3.3.5 and earlier pending vendor patch release; review WordPress user activity logs for suspicious admin page access or script injections during the past 30 days. Within 30 days: Monitor vendor advisory for patched version release and apply immediately upon availability; conduct code audit of admin interface for injected scripts or modified admin settings.

WordPress Admin Bar Improved CVE-2025-30552

HIGH

Cross-Site Request Forgery (CSRF) (CWE-352)

2025-03-24 audit@patchstack.com

WordPress CSRF XSS

7.1

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.1 HIGH

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

Low

Lifecycle Timeline

Analysis Updated

Apr 25, 2026 - 00:18 vuln.today

v2 (cvss_changed)

Re-analysis Queued

Apr 23, 2026 - 15:42 vuln.today

cvss_changed

Analysis Generated

Mar 28, 2026 - 18:33 vuln.today

CVE Published

Mar 24, 2025 - 14:15 nvd

HIGH 7.1

DescriptionCVE.org

Cross-Site Request Forgery (CSRF) vulnerability in Donald Gilbert WordPress Admin Bar Improved allows Stored XSS. This issue affects WordPress Admin Bar Improved: from n/a through 3.3.5.

AnalysisAI

Cross-Site Request Forgery (CSRF) enables stored cross-site scripting (XSS) in WordPress Admin Bar Improved plugin versions up to 3.3.5, allowing attackers to trick authenticated administrators into executing malicious code that persists in the WordPress admin interface. The vulnerability chains CSRF with stored XSS, enabling attackers to inject scripts that execute whenever any user accesses affected admin pages. EPSS exploitation probability is low (0.08%, 24th percentile), no active exploitation confirmed via CISA KEV, and Patchstack has documented this vulnerability with attack chain details.

Technical ContextAI

This vulnerability represents a CSRF-to-XSS attack chain (CWE-352) in a WordPress plugin that modifies the admin toolbar interface. The CSRF vulnerability exists due to insufficient anti-CSRF token validation on plugin settings or configuration endpoints. Successful CSRF exploitation allows attackers to modify plugin settings or inject data without proper authorization. The stored XSS component means malicious JavaScript payloads persist in the WordPress database and execute in admin contexts. The CVSS vector AV:N/AC:L/PR:N/UI:R/S:C indicates network-accessible exploitation with low complexity, requiring no privileges but needing user interaction (admin must visit attacker-controlled page or click malicious link). The changed scope (S:C) reflects XSS execution in victims' browser contexts beyond the vulnerable plugin itself, potentially affecting the entire WordPress admin interface and any logged-in administrator account.

Affected ProductsAI

WordPress Admin Bar Improved plugin versions from initial release through 3.3.5 are vulnerable, affecting WordPress installations running this plugin. The vulnerability exists in the plugin's settings management functionality where CSRF protection is insufficient, allowing the chained CSRF-to-stored-XSS attack. Patchstack documented this vulnerability at https://patchstack.com/database/wordpress/plugin/wordpress-admin-bar-improved/vulnerability/wordpress-wordpress-admin-bar-improved-plugin-3-3-5-csrf-to-stored-xss-vulnerability, which serves as the primary reference for affected version confirmation and technical details.

RemediationAI

Immediately update WordPress Admin Bar Improved plugin to version 3.3.6 or later if available, verifying the patched version through the WordPress plugin repository or Patchstack advisory at https://patchstack.com/database/wordpress/plugin/wordpress-admin-bar-improved/vulnerability/wordpress-wordpress-admin-bar-improved-plugin-3-3-5-csrf-to-stored-xss-vulnerability. If no patched version is confirmed available, deactivate and remove the plugin entirely until vendor releases a fix, replacing functionality with alternative admin bar customization plugins that have recent security updates. As compensating controls if plugin must remain active: implement WordPress-level CSRF protection via security plugins like Wordfence or Sucuri that add request validation layers, restrict WordPress admin access to trusted IP addresses via .htaccess or firewall rules (note: this limits legitimate remote admin access), enable Content Security Policy headers to mitigate XSS execution (may break legitimate admin scripts), and educate administrators to never visit external links while logged into WordPress admin (difficult to enforce, high user friction). Review WordPress admin user sessions and audit plugin settings for unauthorized modifications if exploitation is suspected.