The vulnerability CVE-2025-30560 affects the Sana Ullah jQuery Dropdown Menu plugin (versions <= 3.0) and involves Cross-Site Request Forgery (CSRF) that enables stored Cross-Site Scripting (XSS). This means that an attacker can trick a user into submitting unauthorized requests that result in malicious scripts being stored and executed in the context of the affected application. The CVSS 3.1 base score is 7.1, indicating a high severity with network attack vector, low attack complexity, no privileges required, user interaction required, scope changed, and impacts on confidentiality, integrity, and availability.

Successful exploitation could allow an attacker to execute stored XSS attacks via CSRF, potentially leading to unauthorized actions, data manipulation, or session hijacking within the affected application. The vulnerability impacts confidentiality, integrity, and availability to a limited extent as per the CVSS vector. No known active exploitation has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider disabling or restricting use of the affected jQuery Dropdown Menu plugin versions. Implementing standard CSRF protections and input sanitization may help mitigate risk, but specific vendor guidance should be followed once published.