CVE-2025-2541
📋 TL;DR
The WP Project Manager WordPress plugin has a stored XSS vulnerability in SVG file uploads affecting all versions up to 2.6.22. Authenticated attackers with Author-level access can inject malicious scripts that execute when users view uploaded SVG files. This affects all WordPress sites using vulnerable versions of the plugin.
💻 Affected Systems
- WP Project Manager WordPress plugin
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Attackers could steal admin credentials, deface websites, redirect users to malicious sites, or install backdoors for persistent access.
Likely Case
Attackers with Author accounts inject malicious scripts to steal user session cookies or perform actions on behalf of authenticated users.
If Mitigated
With proper user access controls and content security policies, impact is limited to data leakage from users viewing malicious SVG files.
🎯 Exploit Status
Exploitation requires Author-level access. SVG file upload with embedded JavaScript is straightforward for attackers with basic web skills.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 2.6.23 or later
Vendor Advisory: https://wordpress.org/plugins/wedevs-project-manager/#developers
Restart Required: No
Instructions:
1. Log into WordPress admin panel. 2. Navigate to Plugins > Installed Plugins. 3. Find WP Project Manager. 4. Click 'Update Now' if available. 5. If not, download version 2.6.23+ from WordPress.org and manually update.
🔧 Temporary Workarounds
Disable SVG uploads
allAdd filter to WordPress to block SVG file uploads through the plugin
Add to theme's functions.php or custom plugin: add_filter('upload_mimes', function($mimes) { unset($mimes['svg']); return $mimes; });
Restrict user roles
allLimit Author-level and above permissions to trusted users only
🧯 If You Can't Patch
- Temporarily deactivate the WP Project Manager plugin
- Implement strict Content Security Policy headers to block inline script execution
🔍 How to Verify
Check if Vulnerable:
Check WordPress admin panel > Plugins > Installed Plugins for WP Project Manager version 2.6.22 or earlierCheck Version:
wp plugin list --name='WP Project Manager' --field=versionVerify Fix Applied:
Verify plugin version is 2.6.23 or later in WordPress admin panel📡 Detection & Monitoring
Log Indicators:
- Unusual SVG file uploads by Author-level users
- Multiple failed upload attempts with modified SVG files
Network Indicators:
- Unexpected JavaScript execution from SVG file URLs
- Outbound connections from SVG file views
SIEM Query:
source="wordpress.log" AND "wp-content/uploads" AND ".svg" AND ("Author" OR "Editor" OR "Administrator")🔗 References
- https://plugins.trac.wordpress.org/browser/wedevs-project-manager/tags/2.6.20/core/WP/Frontend.php#L209
- https://plugins.trac.wordpress.org/changeset/3268509/
- https://wordpress.org/plugins/wedevs-project-manager/#developers
- https://www.wordfence.com/threat-intel/vulnerabilities/id/dcc68b62-7dd1-47d4-bbc5-d0237b7c85e7?source=cve
