WP Cassify plugin contains a DOM‑based XSS flaw that allows an attacker to inject arbitrary scripts into pages rendered by the plugin. When a victim visits a crafted URL or interacts with plugin‑generated content, malicious code runs in the victim’s browser, potentially stealing session cookies, defacing the site, or redirecting users.

Known to affect the WordPress WP Cassify plugin developed by Alain‑Aymerick FRANCOIS. All released versions up to 2.3.5 are vulnerable. WordPress installations that use this plugin without an upgrade are at risk.

CVE‑2025‑30771 has a CVSS base score of 6.5, indicating moderate severity. The EPSS score of <1% suggests a low probability of exploitation in the wild, and the vulnerability is not yet listed in CISA’s KEV catalog. The attack likely requires a user to visit or interact with content that incorporates the plugin’s unsanitized output, making it a client‑side risk that an attacker can trigger remotely through crafted URLs or user input.