CVE-2025-22649: WP Project Manager Stored XSS Vulnerability

CVE-2025-22649 Overview

CVE-2025-22649 is a stored cross-site scripting (XSS) vulnerability in the weDevs WP Project Manager plugin for WordPress. The flaw affects all plugin versions up to and including 2.6.22. An authenticated attacker with high privileges can inject malicious script content that is persistently stored and later rendered in victim browsers. The issue is classified under [CWE-79] for improper neutralization of input during web page generation. Exploitation requires user interaction, and the scope change indicates impact beyond the vulnerable component itself.

Critical Impact
Stored script payloads execute in the browser context of users viewing project data, enabling session theft, UI manipulation, or redirection to attacker-controlled resources.

Affected Products

weDevs WP Project Manager versions through 2.6.22
WordPress sites using the wedevs-project-manager plugin
Multi-user WordPress environments where privileged roles can submit project content

Discovery Timeline

2025-03-27 - CVE-2025-22649 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-22649

Vulnerability Analysis

The WP Project Manager plugin fails to sanitize user-supplied input before rendering it within generated web pages. An attacker with authenticated access at a high privilege level can place script payloads into fields processed by the plugin. When another user later loads the affected view, the browser executes the stored payload in the context of the WordPress site.

The vulnerability carries a scope change, meaning injected content can affect resources beyond the plugin component itself. Confidentiality and integrity impacts are limited, and availability is not affected. Because the attack vector is network-based and requires user interaction, exploitation typically relies on victims browsing to project pages containing the payload.

Root Cause

The root cause is missing output encoding and insufficient input filtering within plugin code paths that render project-related data. Content submitted through the plugin interface is persisted in the WordPress database and later echoed into HTML without neutralizing characters such as <, >, and quotes. This allows arbitrary HTML and JavaScript to execute in the context of the viewing user.

Attack Vector

An authenticated attacker with sufficient privileges submits crafted content containing HTML or JavaScript through plugin inputs. The payload is stored server-side. When administrators or other users navigate to the project views, the plugin returns the stored payload in the response body. The browser interprets the content as executable script. Technical details are available in the Patchstack XSS Vulnerability Report.

Detection Methods for CVE-2025-22649

Indicators of Compromise

Project records containing <script>, onerror=, onload=, or javascript: strings in title or description fields
Unexpected outbound requests from administrator browsers to unknown domains after visiting project pages
New or modified WordPress administrator accounts created shortly after a privileged user viewed project content

Detection Strategies

Query the WordPress database for plugin-managed tables and search for HTML tags or event handlers in stored fields
Review web server access logs for POST requests to WP Project Manager REST endpoints submitting unusual payload characters
Enable WordPress audit logging to track content changes made by users with editor or administrator roles

Monitoring Recommendations

Monitor browser-based security tools for Content Security Policy (CSP) violations originating from WordPress admin pages
Alert on new administrator accounts, role changes, and plugin installations that follow suspicious project edits
Track plugin version inventory across managed WordPress deployments to identify instances still running versions through 2.6.22

How to Mitigate CVE-2025-22649

Immediate Actions Required

Update WP Project Manager to a version later than 2.6.22 once the vendor publishes a fix
Audit existing project records for stored HTML or script content and remove malicious entries
Review user roles and remove unnecessary high-privilege accounts that could inject payloads

Patch Information

As of the last NVD update on 2026-06-17, consult the Patchstack advisory for current patch availability. Apply the fixed release through the WordPress plugin management console or by replacing the plugin files directly.

Workarounds

Restrict access to the WP Project Manager plugin to trusted users only, limiting who can create or edit project content
Deploy a web application firewall (WAF) rule that blocks requests containing script tags or event handler attributes targeting plugin endpoints
Enforce a strict Content Security Policy on WordPress admin pages to reduce the impact of injected inline scripts

bash

# Example CSP header for WordPress admin responses
Header set Content-Security-Policy "default-src 'self'; script-src 'self'; object-src 'none'; base-uri 'self'; frame-ancestors 'self'"