The vulnerability CVE-2025-30769 affects the alexvtn WIP WooCarousel Lite plugin (version <= 1.1.7). It is a Cross-Site Request Forgery (CSRF) issue that enables stored Cross-Site Scripting (XSS) attacks. The CVSS 3.1 base score is 7.1, with an attack vector over the network, low complexity, no privileges required, and user interaction needed. The vulnerability impacts confidentiality, integrity, and availability at a low to partial level. No patch or vendor advisory is currently provided, and the product is not a cloud service.

Successful exploitation of this vulnerability could allow an attacker to trick an authenticated user into submitting a forged request, resulting in stored XSS. This can lead to partial compromise of confidentiality, integrity, and availability of the affected system. The impact is rated high based on the CVSS score, but no known active exploitation has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, consider disabling or removing the affected plugin version if feasible. Monitor for updates from the vendor or security advisories related to this vulnerability.