The vulnerability CVE-2025-30612 affects mandegarweb's Replace Default Words plugin up to version 1.3. It is a Cross-Site Request Forgery (CSRF) issue that enables an attacker to inject stored Cross-Site Scripting (XSS) payloads by exploiting the replace-default-words functionality. The CVSS 3.1 base score is 7.1, reflecting network attack vector, low attack complexity, no privileges required, user interaction required, scope changed, and low impact on confidentiality, integrity, and availability. No official patch or vendor advisory is currently available, and the product is not a cloud service.

Successful exploitation of this vulnerability could allow an attacker to execute stored XSS attacks via CSRF, potentially leading to unauthorized actions performed in the context of an authenticated user. This can result in information disclosure, session hijacking, or other impacts related to stored XSS. The overall impact is rated as high severity based on the CVSS score.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider implementing CSRF protections such as verifying anti-CSRF tokens and restricting access to the vulnerable functionality. Monitoring for suspicious activity related to stored XSS attempts is recommended. No vendor advisory or patch links are currently provided.