CVE-2025-30983: 
WordPress vulnerability analysis and mitigation

A Cross-site Scripting (XSS) vulnerability has been identified in gopiplus Card flip image slideshow WordPress plugin through version 1.5. The vulnerability was discovered and reported on July 4, 2025, and allows DOM-Based XSS attacks (NVD CVE, Patchstack Report).

The vulnerability is classified as a DOM-Based Cross-site Scripting (XSS) issue with a CVSS v3.1 Base Score of 6.5 (Medium), with the vector string CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L. The vulnerability is tracked as CWE-79 (Improper Neutralization of Input During Web Page Generation) (NVD CVE).

This vulnerability could allow malicious actors to inject malicious scripts, including redirects, advertisements, and other HTML payloads into websites using the affected plugin. These injected scripts would be executed when visitors access the compromised site (Patchstack Report).

No official fix is currently available for this vulnerability. The recommended action is to remove and replace the software with an alternative solution, as the plugin appears to be abandoned and is unlikely to receive future updates or security fixes (Patchstack Report).