Cross-Site Request Forgery Vulnerability in OTWthemes Widgetize Pages Light
CVE-2025-30995

7.1HIGH

Key Information:

Vendor: WordPress
Status: Widgetize Pages Light
Vendor: CVE Published:; 6 June 2025

What is CVE-2025-30995?

A Cross-Site Request Forgery (CSRF) vulnerability in the OTWthemes Widgetize Pages Light allows attackers to execute unauthorized actions on behalf of authenticated users, potentially leading to Stored Cross-Site Scripting (XSS) attacks. This vulnerability affects versions ranging from n/a through 3.0, enabling risk exposure to users who have the plugin installed.

Affected Version(s)

Widgetize Pages Light <= 3.0

References

https://patchstack.com/database/wordpress/plugin/widgetiz...

vdb-entry

CVSS V3.1

Score:

7.1

Severity:

HIGH

Confidentiality:

Low

Integrity:

Low

Availability:

Low

Attack Vector:

Network

Attack Complexity:

Low

Privileges Required:

None

User Interaction:

Required

Scope:

Changed

Download the Critical Vulnerability Management Cheat Sheet

Timeline

Vulnerability published
Jun 6, 2025
Vulnerability Reserved
Mar 26, 2025

Credit

Nguyen Tran Tuan Dung (domiee13) (Patchstack Alliance)