CVE-2025-3100: WP Project Manager Stored XSS Vulnerability

CVE-2025-3100 Overview

CVE-2025-3100 is a Stored Cross-Site Scripting (XSS) vulnerability [CWE-79] in the WP Project Manager plugin for WordPress, developed by weDevs. The flaw affects all versions up to and including 2.6.22. The plugin fails to properly sanitize uploads and escape output in the task discussion feature, allowing Scalable Vector Graphics (SVG) files containing embedded scripts to be uploaded and served.

Authenticated attackers with Subscriber-level access or higher, when granted project permissions by an administrator, can inject arbitrary JavaScript. The injected scripts execute whenever a user accesses the uploaded SVG file.

Critical Impact
Authenticated attackers can execute arbitrary JavaScript in the browser context of any user who views a malicious SVG, enabling session theft, administrative action hijacking, and site defacement.

Affected Products

weDevs WP Project Manager plugin for WordPress
All versions up to and including 2.6.22
WordPress sites using the task discussion / file upload feature

Discovery Timeline

2025-04-09 - CVE-2025-3100 published to the National Vulnerability Database
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-3100

Vulnerability Analysis

The vulnerability resides in the file upload handling path exposed through the task discussion component of WP Project Manager. The plugin accepts SVG files without stripping embedded scripting constructs such as <script> tags or event handler attributes. Because SVG is an XML-based format that browsers render and execute as active content, any embedded JavaScript runs when the file is loaded directly or embedded in a page.

Files uploaded through this flow are stored on the WordPress host and served from the site's own origin. Scripts executing from this origin inherit access to cookies, the authenticated session, and the Document Object Model of pages served from the same domain.

The S:C component in the CVSS vector indicates a scope change, reflecting that code executing from an attacker-controlled SVG can affect resources beyond the vulnerable component, including other users of the WordPress site.

Root Cause

The root cause is insufficient input sanitization and output escaping in the file upload helper used by the task discussion feature. Relevant code is located in WP Project Manager File Helper. The plugin does not strip active content from SVG payloads before storing them, and does not force a safe Content-Type or Content-Disposition when delivering the file.

Attack Vector

Exploitation requires an authenticated account at Subscriber level or above, plus project access granted by an administrator. The attacker crafts an SVG containing a <script> element or event-handler attribute, then uploads it as an attachment in a task discussion. When another user, including an administrator, opens the attachment URL, the embedded JavaScript executes in that user's browser against the WordPress origin.

Technical details of the fix are documented in WordPress Changeset #3268509 and the Wordfence Vulnerability Report.

Detection Methods for CVE-2025-3100

Indicators of Compromise

SVG files uploaded to wp-content/uploads/ containing <script>, onload=, onerror=, or onclick= attributes
Unexpected JavaScript execution when viewing WP Project Manager task attachments
New or elevated administrator accounts created shortly after an SVG attachment was accessed
Outbound requests from the WordPress origin to unfamiliar domains after SVG viewing events

Detection Strategies

Scan the uploads directory for SVG files and inspect XML content for embedded scripting elements and event handler attributes
Review WP Project Manager task discussion logs for file uploads originating from Subscriber-level accounts
Correlate SVG upload events with subsequent privilege changes in the WordPress wp_users and wp_usermeta tables

Monitoring Recommendations

Enable WordPress audit logging for file uploads, user role changes, and plugin configuration edits
Monitor HTTP responses serving .svg files to confirm Content-Type headers and absence of inline script execution
Alert on account creation or role elevation events that follow attachment access within the plugin

How to Mitigate CVE-2025-3100

Immediate Actions Required

Update WP Project Manager to a version later than 2.6.22 that incorporates the fix from changeset 3268509
Audit existing SVG attachments in task discussions and remove any containing script content
Review Subscriber and contributor accounts, revoking project access granted by administrators where it is no longer required
Rotate credentials and session tokens for administrators who may have viewed malicious attachments

Patch Information

The vendor addressed the issue in a release referenced by WordPress Changeset #3268509, which modifies the plugin loader to restrict SVG handling. Site operators should apply the latest available WP Project Manager update through the WordPress plugin interface.

Workarounds

Disable the WP Project Manager plugin until the patched version can be deployed
Block SVG uploads at the web application firewall or WordPress MIME type filter by removing image/svg+xml from allowed upload types
Restrict project membership to trusted users and avoid granting file upload permissions to Subscriber-level accounts
Serve user-uploaded files from a separate sandbox domain to isolate script execution from the primary WordPress origin

bash

# Example: disallow SVG uploads via WordPress filter in functions.php
add_filter('upload_mimes', function($mimes) {
    unset($mimes['svg']);
    unset($mimes['svgz']);
    return $mimes;
});