CVE-2025-2575

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-2575", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "state": "PUBLISHED", "assignerShortName": "Wordfence", "dateReserved": "2025-03-20T21:01:02.722Z", "datePublished": "2025-04-11T11:11:57.129Z", "dateUpdated": "2026-04-08T17:28:50.346Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T17:28:50.346Z"}, "affected": [{"vendor": "wpzita", "product": "Z Companion", "versions": [{"version": "0", "status": "affected", "lessThanOrEqual": "1.1.1", "versionType": "semver"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "The Z Companion plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up to, and including, 1.1.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Author-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses the SVG file. Note: This requires Royal Shop theme to be installed."}], "title": "Z Companion <= 1.1.1 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Upload", "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/e0f7bba4-76c3-4904-bd96-2074147b33f5?source=cve"}, {"url": "https://plugins.trac.wordpress.org/browser/z-companion/trunk/import/importer/wxr-importer.php#L149"}, {"url": "https://plugins.trac.wordpress.org/browser/z-companion/trunk/import/importer/wxr-importer.php#L63"}, {"url": "https://plugins.trac.wordpress.org/browser/z-companion/trunk/import/inc/importer.php#L148"}, {"url": "https://plugins.trac.wordpress.org/browser/z-companion/trunk/import/inc/importer.php#L62"}, {"url": "https://wordpress.org/plugins/z-companion/#developers"}, {"url": "https://plugins.trac.wordpress.org/changeset/3270130/"}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')", "cweId": "CWE-79", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N", "baseScore": 6.4, "baseSeverity": "MEDIUM"}}], "credits": [{"lang": "en", "type": "finder", "value": "Avraham Shemesh"}], "timeline": [{"time": "2025-04-10T22:24:22.000Z", "lang": "en", "value": "Disclosed"}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2025-04-11T13:22:27.323503Z", "id": "CVE-2025-2575", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-04-11T13:22:37.709Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-2575", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2025-04-11T13:22:27.323503Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-04-11T13:22:31.595Z"}}], "cna": {"title": "Z Companion <= 1.1.1 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Upload", "credits": [{"lang": "en", "type": "finder", "value": "Avraham Shemesh"}], "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 6.4, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"}}], "affected": [{"vendor": "wpzita", "product": "Z Companion", "versions": [{"status": "affected", "version": "*", "versionType": "semver", "lessThanOrEqual": "1.1.1"}], "defaultStatus": "unaffected"}], "timeline": [{"lang": "en", "time": "2025-04-10T22:24:22.000+00:00", "value": "Disclosed"}], "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/e0f7bba4-76c3-4904-bd96-2074147b33f5?source=cve"}, {"url": "https://plugins.trac.wordpress.org/browser/z-companion/trunk/import/importer/wxr-importer.php#L149"}, {"url": "https://plugins.trac.wordpress.org/browser/z-companion/trunk/import/importer/wxr-importer.php#L63"}, {"url": "https://plugins.trac.wordpress.org/browser/z-companion/trunk/import/inc/importer.php#L148"}, {"url": "https://plugins.trac.wordpress.org/browser/z-companion/trunk/import/inc/importer.php#L62"}, {"url": "https://wordpress.org/plugins/z-companion/#developers"}, {"url": "https://plugins.trac.wordpress.org/changeset/3270130/"}], "descriptions": [{"lang": "en", "value": "The Z Companion plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up to, and including, 1.1.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Author-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses the SVG file. Note: This requires Royal Shop theme to be installed."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-79", "description": "CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')"}]}], "providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2025-04-11T11:11:57.129Z"}}}, "cveMetadata": {"cveId": "CVE-2025-2575", "state": "PUBLISHED", "dateUpdated": "2025-04-11T13:22:37.709Z", "dateReserved": "2025-03-20T21:01:02.722Z", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "datePublished": "2025-04-11T11:11:57.129Z", "assignerShortName": "Wordfence"}, "dataVersion": "5.1"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Z Companion", "vendor": "wpzita", "versions": [{"lessThanOrEqual": "1.1.1", "status": "affected", "version": "0", "versionType": "semver"}]}], "source": "security@wordfence.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:wpzita:z_companion:*:*:*:*:*:wordpress:*:*", "matchCriteriaId": "5D9BA9D7-A2B0-4B24-AD7B-BD21C17A92ED", "versionEndIncluding": "1.1.2", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "The Z Companion plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up to, and including, 1.1.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Author-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses the SVG file. Note: This requires Royal Shop theme to be installed."}, {"lang": "es", "value": "El complemento Z Companion para WordPress es vulnerable a Cross-Site Scripting almacenado al subir archivos SVG en todas las versiones hasta la 1.1.1 incluida, debido a una depuraci\u00f3n de entrada y un escape de salida insuficientes. Esto permite a atacantes autenticados, con acceso de autor o superior, inyectar scripts web arbitrarios en las p\u00e1ginas que se ejecutar\u00e1n al acceder un usuario al archivo SVG. Nota: Esto requiere la instalaci\u00f3n del tema Royal Shop."}], "id": "CVE-2025-2575", "lastModified": "2026-06-17T09:07:12.680", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.4, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 3.1, "impactScore": 2.7, "source": "security@wordfence.com", "type": "Secondary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.4, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 2.3, "impactScore": 2.7, "source": "nvd@nist.gov", "type": "Primary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-2575", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2025-04-11T13:22:27.323503Z", "version": "2.0.3"}}]}, "published": "2025-04-11T12:15:15.490", "references": [{"source": "security@wordfence.com", "tags": ["Product"], "url": "https://plugins.trac.wordpress.org/browser/z-companion/trunk/import/importer/wxr-importer.php#L149"}, {"source": "security@wordfence.com", "tags": ["Product"], "url": "https://plugins.trac.wordpress.org/browser/z-companion/trunk/import/importer/wxr-importer.php#L63"}, {"source": "security@wordfence.com", "tags": ["Product"], "url": "https://plugins.trac.wordpress.org/browser/z-companion/trunk/import/inc/importer.php#L148"}, {"source": "security@wordfence.com", "tags": ["Product"], "url": "https://plugins.trac.wordpress.org/browser/z-companion/trunk/import/inc/importer.php#L62"}, {"source": "security@wordfence.com", "tags": ["Patch"], "url": "https://plugins.trac.wordpress.org/changeset/3270130/"}, {"source": "security@wordfence.com", "tags": ["Product"], "url": "https://wordpress.org/plugins/z-companion/#developers"}, {"source": "security@wordfence.com", "tags": ["Third Party Advisory"], "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/e0f7bba4-76c3-4904-bd96-2074147b33f5?source=cve"}], "sourceIdentifier": "security@wordfence.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-79"}], "source": "security@wordfence.com", "type": "Secondary"}]}

{}

{"analysis": {"en": {"generated_at": "2026-04-20T23:17:59.138383+00:00", "value": {"mitigation_remediation": ["Upgrade the Z Companion plugin to a version newer than 1.1.1, if available. ", "If an update is not possible, disable SVG file uploads or replace the Royal Shop theme with one that does not allow SVG usage. ", "Restrict the Author role so that users cannot upload files, or enforce stricter file\u2011type validation via a security plugin. "], "summary": {"action": "Apply Patch", "impact": "Stored Cross\u2011Site Scripting"}, "threat_synthesis": {"affected_systems": "This vulnerability affects any WordPress site running Z Companion version 1.1.1 or older, and requires the Royal Shop theme to be installed. The affected product is listed as wpzita:Z Companion under the vendor name wpzita in the WordPress ecosystem.\n", "description_and_impact": "The Z Companion plugin for WordPress allows authenticated users with Author privileges or higher to upload SVG files that are not properly sanitized or escaped. An attacker can inject arbitrary JavaScript into the SVG, which will execute whenever a site visitor views the image. This stored XSS can lead to session hijacking, credential theft, defacement, or silent data exfiltration, compromising the confidentiality, integrity, and availability of the site\u2019s visitors.\n", "risk_and_exploitability": "The CVSS score for this flaw is 6.4, indicating moderate severity. The EPSS score is below 1\u202f%, suggesting the probability of exploitation is very low at present, and the vulnerability is not listed in the CISA KEV catalog. However, because the attack requires only Author-level credentials\u2014which many sites assign to content creators\u2014the attacker needs only legitimate access rights. Once a malicious SVG is uploaded, any visitor who requests the file will be exposed to the injected script, enabling the attacker to gain further foothold or data from unsuspecting users."}}}}, "created": "2026-04-20T23:30:16.104031+00:00", "updated": "2026-04-20T23:30:16.104045+00:00", "vendors": []}