The vulnerability CVE-2025-30971 in Xavi Ivars XV Random Quotes (versions up to 2.0.0) is an SQL Injection flaw caused by improper neutralization of special elements in SQL commands. This allows remote attackers to inject malicious SQL code without authentication or user interaction, potentially compromising data confidentiality and causing limited availability impact. The CVSS v3.1 score is 9.3 (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L), reflecting critical severity. No patch or vendor advisory is currently available to confirm remediation status.

Successful exploitation could allow remote attackers to execute arbitrary SQL commands on the affected database, leading to high confidentiality impact such as unauthorized data disclosure. Integrity impact is not indicated, and availability impact is low. The vulnerability is exploitable over the network without authentication or user interaction, increasing risk.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider applying workarounds such as input validation or disabling vulnerable features if possible. Monitor vendor channels for updates and apply patches promptly once available.