CVE-2025-30528 CRITICAL

CVE-2025-30528: WordPress Awesome Logos plugin <= 1.2 - CSRF to SQL Injection vulnerability

Vendor Wpshopee

Product Awesome Logos

Weakness CWE-352 · CSRF

Published March 24, 2025

Last update April 28, 2026

View on NVD All CVEs

CVSS base score

9.3/10

Attack vector Network

Attack complexity Low

Privileges required None

User interaction None

Confidentiality High

Integrity None

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L

What the vulnerability does

01Description

Cross-Site Request Forgery (CSRF) vulnerability in wpshopee Awesome Logos awesome-logos allows SQL Injection.This issue affects Awesome Logos: from n/a through <= 1.2.

Explanation of Vulnerability in Simple Terms

02Summary

Awesome Logos versions 1.2 and earlier contain a cross-site request forgery (CSRF) vulnerability that allows attackers to perform unauthorized actions on behalf of site administrators without their knowledge. The vulnerability requires no authentication and can be exploited remotely. An attacker can trigger unwanted changes to site configuration or data by tricking an admin into visiting a malicious page.

What an attacker can do

03Attacker Capabilities

Perform unauthorized actions on the site by tricking an admin into visiting a malicious page.

Potential impact on your site

04Site Impact

Attackers can modify site settings, content, or configuration without your permission if you visit a malicious link.

Conditions required to exploit

05Prerequisites

Site admin must visit a page controlled by the attacker while logged into WordPress.

Key dates

06Disclosure timeline

March 24, 2025 CVE published

April 28, 2026 Record updated

External resources

07References

NVD — National Vulnerability Database https://nvd.nist.gov/vuln/detail/CVE-2025-30528 CWE — Common Weakness Enumeration https://cwe.mitre.org/data/definitions/352.html AskarLabs — CWE-352 write-up Cross-Site Request Forgery

Related vulnerabilities