CVE-2025-30554: 
WordPress vulnerability analysis and mitigation

A Reflected Cross-Site Scripting (XSS) vulnerability has been identified in the WordPress Frizzly plugin, tracked as CVE-2025-30554. The vulnerability affects versions through 1.1.0 of the Frizzly plugin and was disclosed on April 1, 2025. This security flaw allows for improper neutralization of input during web page generation (NVD, Patchstack).

The vulnerability has been assigned a CVSS v3.1 base score of 7.1 (HIGH) with the vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L. The vulnerability is classified under CWE-79: Improper Neutralization of Input During Web Page Generation. This reflected XSS vulnerability allows attackers to inject malicious scripts that can be executed when users visit the affected site (NVD, Patchstack).

The vulnerability could allow malicious actors to inject malicious scripts, including redirects, advertisements, and other HTML payloads into the website, which will be executed when guests visit the site. The CVSS scoring indicates potential impacts on confidentiality, integrity, and availability, all rated as Low (Patchstack).

The vulnerability is exploitable by unauthenticated attackers and requires user interaction. The attack complexity is rated as Low, indicating relatively straightforward exploitation. No official fix is currently available, and the vulnerability is expected to become actively exploited (Patchstack).

While no official fix is currently available, Patchstack has issued a virtual patch to mitigate this issue by blocking potential attacks. Website administrators are advised to implement the virtual patch immediately until an official fix becomes available (Patchstack).

The vulnerability was initially reported by security researcher 0xd4rk5id3 on February 28, 2025. Early warning was sent to Patchstack customers on April 1, 2025, before the public disclosure on April 3, 2025 (Patchstack).