CVE-2025-30963: 
WordPress vulnerability analysis and mitigation

The CVE-2025-30963 is a Cross-site Scripting (XSS) vulnerability discovered in Crocoblock's JetSmartFilters WordPress plugin affecting versions through 3.6.3. The vulnerability was disclosed on March 31, 2025, and is specifically classified as a DOM-Based XSS issue related to improper neutralization of input during web page generation (NVD).

The vulnerability is classified as a DOM-Based Cross-site Scripting (XSS) issue with a CVSS v3.1 base score of 6.5 (MEDIUM). The attack vector requires network access (AV:N), low attack complexity (AC:L), low privileges (PR:L), user interaction (UI:R), and has changed scope (S:C) with low impacts on confidentiality, integrity, and availability (C:L/I:L/A:L). The vulnerability is tracked under CWE-79: Improper Neutralization of Input During Web Page Generation (NVD, Patchstack).

The vulnerability allows attackers to perform DOM-Based Cross-site Scripting attacks, which could potentially lead to unauthorized access to user data, session hijacking, or manipulation of web content displayed to users (NVD).

The vulnerability requires low attack complexity and low privileges to exploit, though it does need user interaction. The attack can be launched remotely over the network, making it accessible to remote attackers (NVD).

Users of JetSmartFilters are advised to update their installations to versions newer than 3.6.3 once available, as this version is confirmed to be vulnerable (NVD).