CVE-2025-30566: 
WordPress vulnerability analysis and mitigation

A Cross-site Scripting (XSS) vulnerability was discovered in Aryan Themes Clink WordPress plugin, identified as CVE-2025-30566. The vulnerability affects versions through 1.2.2 and specifically involves DOM-Based XSS due to improper neutralization of input during web page generation. The issue was initially reported on March 13, 2025, and was publicly disclosed on March 24, 2025 (Patchstack).

The vulnerability has been classified as CWE-79 (Improper Neutralization of Input During Web Page Generation). It received a CVSS v3.1 base score of 6.5 (Medium), with the following vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L. This indicates that the vulnerability requires network access, low attack complexity, low privileges, and user interaction, with impacts to confidentiality, integrity, and availability all rated as low (Patchstack).

The vulnerability could allow malicious actors to inject malicious scripts, including redirects, advertisements, and other HTML payloads into the website. These injected scripts would be executed when visitors access the affected site. The attack requires contributor-level privileges to exploit (Patchstack).

The vulnerability has been assessed with a low patch priority, suggesting it is unlikely to be exploited. The attack requires contributor-level access to the WordPress installation, which limits the potential attack surface (Patchstack).

As of the disclosure date, no official fix has been released for this vulnerability. The issue affects versions up to and including 1.2.2 of the Clink plugin (Patchstack).