CVE-2025-2541: WP Project Manager XSS Vulnerability

CVE-2025-2541 Overview

CVE-2025-2541 is a stored Cross-Site Scripting (XSS) vulnerability in the WP Project Manager plugin for WordPress, developed by weDevs. The flaw affects all versions up to and including 2.6.22 and stems from insufficient input sanitization and output escaping during Scalable Vector Graphics (SVG) file uploads. Authenticated attackers with Author-level access or higher can upload SVG files containing arbitrary JavaScript. The scripts execute in the browser of any user who views the uploaded file. The weakness is categorized under [CWE-79]: Improper Neutralization of Input During Web Page Generation.

Critical Impact
Authenticated attackers with Author privileges can inject persistent JavaScript that executes in the browser of any user accessing the malicious SVG, enabling session theft, defacement, or redirection.

Affected Products

weDevs WP Project Manager plugin for WordPress (all versions ≤ 2.6.22)
WordPress sites permitting Author-level or higher user roles
Deployments allowing SVG uploads through the plugin's file handling routines

Discovery Timeline

2025-04-11 - CVE-2025-2541 published to the National Vulnerability Database (NVD)
2026-06-17 - Last updated in the NVD database

Technical Details for CVE-2025-2541

Vulnerability Analysis

The vulnerability resides in the WP Project Manager plugin's frontend file upload handling. The plugin accepts SVG files without validating or sanitizing embedded scripting content. SVG is an Extensible Markup Language (XML) based image format that natively supports <script> tags and JavaScript event handlers such as onload or onclick. When the plugin serves an uploaded SVG directly to a browser, the browser parses and executes any embedded JavaScript in the context of the WordPress site's origin. Attackers exploit this to run scripts within victim sessions, targeting administrators or other users who open the file.

Because the payload persists on the server, this is a stored XSS class rather than reflected. Every subsequent view of the SVG re-triggers the payload. The relevant upload handling logic can be reviewed in the WordPress Frontend Code Review.

Root Cause

The root cause is missing MIME validation combined with the absence of output escaping when the plugin processes uploaded files. The plugin trusts the file extension and stores SVGs verbatim without stripping <script> blocks, event handlers, or <foreignObject> content that can execute JavaScript. WordPress core blocks SVG uploads by default, but the plugin's upload path bypasses this protection.

Attack Vector

Exploitation requires an authenticated account with Author role or higher. The attacker crafts an SVG file containing JavaScript inside a <script> element or an event attribute. They upload the file through the WP Project Manager task or project attachment interface. When any user, including an administrator, opens the SVG URL, the browser executes the payload in the site's origin. Consequences include cookie theft, forced administrative actions via same-origin requests, and phishing overlays. User interaction is required to view the file, but attackers can distribute the link through in-plugin messages or project comments. See the Wordfence Vulnerability Analysis for additional detail.

Detection Methods for CVE-2025-2541

Indicators of Compromise

SVG files in the WordPress uploads directory containing <script> tags, javascript: URIs, or event handler attributes such as onload, onerror, or onclick.
Unexpected outbound requests from administrator browsers to attacker-controlled domains shortly after opening SVG attachments.
Author-role accounts uploading image files with .svg extensions to WP Project Manager tasks or projects.

Detection Strategies

Scan the wp-content/uploads/ directory for SVG files and inspect their XML content for scripting constructs.
Review WordPress audit logs for file upload events originating from non-administrative accounts targeting the WP Project Manager endpoints.
Monitor HTTP responses that serve Content-Type: image/svg+xml alongside JavaScript payloads.

Monitoring Recommendations

Enable WordPress activity logging plugins to track file uploads, user role changes, and administrative session activity.
Deploy a web application firewall rule that inspects uploaded SVG content for <script> or on*= attributes before storage.
Alert on new or modified files under the plugin's upload paths, particularly files served with SVG MIME types.

How to Mitigate CVE-2025-2541

Immediate Actions Required

Update the WP Project Manager plugin to a version newer than 2.6.22 that includes the fix from WordPress Changeset #3268509.
Audit existing SVG files stored by the plugin and remove any containing scripting content.
Restrict Author-level and higher accounts to trusted users and rotate credentials for any accounts suspected of compromise.

Patch Information

weDevs addressed the flaw in the plugin repository via WordPress Changeset #3268509. Administrators should apply the patched release through the WordPress plugin manager. Confirm the installed version exceeds 2.6.22 after updating. Additional release information is available on the WP Project Manager Developer Info page.

Workarounds

Disable SVG uploads at the WordPress level until the patched plugin version is deployed.
Serve uploaded SVG files with a Content-Disposition: attachment header to force download rather than inline rendering.
Apply a Content Security Policy (CSP) that blocks inline script execution on pages that render user-uploaded content.

bash

# Nginx configuration to force SVG downloads instead of inline rendering
location ~* \.svg$ {
    add_header Content-Disposition "attachment";
    add_header X-Content-Type-Options "nosniff";
}