CVE-2025-30900: WordPress Zoho Billing – Embed Payment Form plugin <= 4.0 - Stored Cross Site Scripting (XSS) vulnerability
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Zoho Subscriptions Zoho Billing – Embed Payment Form allows Stored XSS. This issue affects Zoho Billing – Embed Payment Form: from n/a through 4.0.
Affected Software
Remediation
Information
Event History
Frequently Asked Questions
What is the severity of CVE-2025-30900?
The severity of CVE-2025-30900 is classified as high due to its potential for stored cross-site scripting attacks.
How do I fix CVE-2025-30900?
To fix CVE-2025-30900, update Zoho Billing – Embed Payment Form to version 4.1 or later.
What software is affected by CVE-2025-30900?
CVE-2025-30900 affects Zoho Billing – Embed Payment Form up to version 4.0 and the WordPress Zoho Billing – Embed Payment Form plugin up to version 4.0.
What kind of attack does CVE-2025-30900 enable?
CVE-2025-30900 enables stored cross-site scripting (XSS) attacks, allowing malicious scripts to be executed in the context of a user's browser.
Is there a workaround for CVE-2025-30900?
Currently, the best workaround for CVE-2025-30900 is to apply the available security updates or switch to a different payment form solution.