CVE-2025-2541

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-2541", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "state": "PUBLISHED", "assignerShortName": "Wordfence", "dateReserved": "2025-03-19T22:51:11.818Z", "datePublished": "2025-04-11T11:11:56.437Z", "dateUpdated": "2026-04-08T17:27:53.680Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T17:27:53.680Z"}, "affected": [{"vendor": "wedevs", "product": "Project Manager \u2013 AI Powered Project Management, Task Management, Kanban Board & Time Tracker", "versions": [{"version": "0", "status": "affected", "lessThanOrEqual": "2.6.22", "versionType": "semver"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "The WP Project Manager plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up to, and including, 2.6.22 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Author-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses the SVG file."}], "title": "WP Project Manager <= 2.6.22 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Upload", "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/dcc68b62-7dd1-47d4-bbc5-d0237b7c85e7?source=cve"}, {"url": "https://plugins.trac.wordpress.org/browser/wedevs-project-manager/tags/2.6.20/core/WP/Frontend.php#L209"}, {"url": "https://wordpress.org/plugins/wedevs-project-manager/#developers"}, {"url": "https://plugins.trac.wordpress.org/changeset/3268509/"}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')", "cweId": "CWE-79", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N", "baseScore": 6.4, "baseSeverity": "MEDIUM"}}], "credits": [{"lang": "en", "type": "finder", "value": "Avraham Shemesh"}], "timeline": [{"time": "2025-04-10T22:38:47.000Z", "lang": "en", "value": "Disclosed"}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2025-04-11T13:23:00.339491Z", "id": "CVE-2025-2541", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-04-11T13:23:10.793Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-2541", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2025-04-11T13:23:00.339491Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-04-11T13:23:07.007Z"}}], "cna": {"title": "WP Project Manager <= 2.6.22 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Upload", "credits": [{"lang": "en", "type": "finder", "value": "Avraham Shemesh"}], "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 6.4, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"}}], "affected": [{"vendor": "wedevs", "product": "Project Manager \u2013 AI Powered Project Management, Task Management, Kanban Board & Time Tracker", "versions": [{"status": "affected", "version": "0", "versionType": "semver", "lessThanOrEqual": "2.6.22"}], "defaultStatus": "unaffected"}], "timeline": [{"lang": "en", "time": "2025-04-10T22:38:47.000Z", "value": "Disclosed"}], "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/dcc68b62-7dd1-47d4-bbc5-d0237b7c85e7?source=cve"}, {"url": "https://plugins.trac.wordpress.org/browser/wedevs-project-manager/tags/2.6.20/core/WP/Frontend.php#L209"}, {"url": "https://wordpress.org/plugins/wedevs-project-manager/#developers"}, {"url": "https://plugins.trac.wordpress.org/changeset/3268509/"}], "descriptions": [{"lang": "en", "value": "The WP Project Manager plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up to, and including, 2.6.22 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Author-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses the SVG file."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-79", "description": "CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')"}]}], "providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T17:27:53.680Z"}}}, "cveMetadata": {"cveId": "CVE-2025-2541", "state": "PUBLISHED", "dateUpdated": "2026-04-08T17:27:53.680Z", "dateReserved": "2025-03-19T22:51:11.818Z", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "datePublished": "2025-04-11T11:11:56.437Z", "assignerShortName": "Wordfence"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Project Manager \u2013 AI Powered Project Management, Task Management, Kanban Board & Time Tracker", "vendor": "wedevs", "versions": [{"lessThanOrEqual": "2.6.22", "status": "affected", "version": "0", "versionType": "semver"}]}], "source": "security@wordfence.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:wedevs:wp_project_manager:*:*:*:*:*:wordpress:*:*", "matchCriteriaId": "78040791-6F50-4A88-B8C3-7F359B94478A", "versionEndExcluding": "2.6.23", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "The WP Project Manager plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up to, and including, 2.6.22 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Author-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses the SVG file."}, {"lang": "es", "value": "El plugin WP Project Manager para WordPress es vulnerable a Cross-Site Scripting almacenado al subir archivos SVG en todas las versiones hasta la 2.6.22 incluida, debido a una depuraci\u00f3n de entrada y un escape de salida insuficientes. Esto permite a atacantes autenticados, con acceso de autor o superior, inyectar scripts web arbitrarios en p\u00e1ginas que se ejecutar\u00e1n al acceder un usuario al archivo SVG."}], "id": "CVE-2025-2541", "lastModified": "2026-06-17T09:07:08.603", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.4, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 3.1, "impactScore": 2.7, "source": "security@wordfence.com", "type": "Secondary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.4, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 2.3, "impactScore": 2.7, "source": "nvd@nist.gov", "type": "Primary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-2541", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2025-04-11T13:23:00.339491Z", "version": "2.0.3"}}]}, "published": "2025-04-11T12:15:15.343", "references": [{"source": "security@wordfence.com", "tags": ["Product"], "url": "https://plugins.trac.wordpress.org/browser/wedevs-project-manager/tags/2.6.20/core/WP/Frontend.php#L209"}, {"source": "security@wordfence.com", "tags": ["Patch"], "url": "https://plugins.trac.wordpress.org/changeset/3268509/"}, {"source": "security@wordfence.com", "tags": ["Product"], "url": "https://wordpress.org/plugins/wedevs-project-manager/#developers"}, {"source": "security@wordfence.com", "tags": ["Third Party Advisory"], "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/dcc68b62-7dd1-47d4-bbc5-d0237b7c85e7?source=cve"}], "sourceIdentifier": "security@wordfence.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-79"}], "source": "security@wordfence.com", "type": "Secondary"}]}

{}

{"analysis": {"en": {"generated_at": "2026-04-20T23:18:20.109932+00:00", "value": {"mitigation_remediation": ["Upgrade WP Project Manager to version 2.6.23 or later to eliminate the SVG upload vulnerability", "If an immediate upgrade is not possible, configure the plugin or the WordPress media library to disallow SVG uploads from all users and delete any existing SVG files in the plugin\u2019s upload directory", "Restrict the role that can upload files through the plugin to the least privilege required for project management operations, ensuring that only users higher than Editor can use the upload feature"], "summary": {"action": "Immediate Patch", "impact": "Stored Cross\u2011Site Scripting (authenticated attacker can inject scripts into SVG uploads)"}, "threat_synthesis": {"affected_systems": "All installations of the WP Project Manager plugin from developers Wedevs, specifically versions 2.6.22 and older, run on WordPress sites. The plugin provides AI\u2011powered project, task, Kanban and time\u2011tracking features.", "description_and_impact": "The WP Project Manager plugin for WordPress contains a stored XSS flaw caused by inadequate sanitization and escaping of SVG files. An authenticated user with Author privileges or higher can upload a malicious SVG; when any user opens that file, the browser executes the injected script, potentially allowing the attacker to deface the site, hijack sessions or exfiltrate data. The weakness is a classic input validation flaw (CWE\u201179).", "risk_and_exploitability": "The CVSS v3.1 base score is 6.4, reflecting a medium severity due to the requirement of authenticated author access and the impact on integrity, confidentiality and availability. The EPSS score is below 1\u202f%, indicating a low but non\u2011zero probability of exploitation. The vulnerability is not listed in the CISA KEV catalog. Attackers would need user privileges to upload a malicious SVG, after which the malicious code runs in the browsers of any user who views the file. A dedicated exploit is unlikely due to the narrow prerequisites, but organizations using known vulnerable versions should prioritize the fix."}}}}, "created": "2026-04-20T23:30:16.104404+00:00", "updated": "2026-04-20T23:30:16.104417+00:00", "vendors": []}