CVE-2025-2573: Amazing service box Addons For WPBakery Page Builder <= 2.0.0 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Upload
First published: Wed Mar 26 2025(Updated: )
The Amazing service box Addons For WPBakery Page Builder (formerly Visual Composer) plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up to, and including, 2.0.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Author-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses the SVG file.
Credit: security@wordfence.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Amazing service box Addons For WPBakery Page Builder | <=2.0.0 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://www.wordfence.com/threat-intel/vulnerabilities/id/a4f6ce4d-6ca5-4a62-ae84-9dd190fc0392?source=cve
- https://plugins.trac.wordpress.org/browser/amazing-service-box-visual-composer-addons/trunk/asb_addon.php#L114
- https://plugins.trac.wordpress.org/browser/amazing-service-box-visual-composer-addons/trunk/asb_addon.php#L45
- https://wordpress.org/plugins/amazing-service-box-visual-composer-addons/#developers
Frequently Asked Questions
What is the severity of CVE-2025-2573?
CVE-2025-2573 has a high severity due to the potential for Stored Cross-Site Scripting attacks.
How do I fix CVE-2025-2573?
To fix CVE-2025-2573, update the Amazing Service Box Addons For WPBakery Page Builder plugin to version 2.0.1 or later.
What types of attacks can CVE-2025-2573 facilitate?
CVE-2025-2573 can facilitate Stored Cross-Site Scripting attacks through malicious SVG file uploads.
Which versions are affected by CVE-2025-2573?
CVE-2025-2573 affects all versions of the Amazing Service Box Addons For WPBakery Page Builder plugin up to and including version 2.0.0.
Is input sanitization the issue in CVE-2025-2573?
Yes, the core issue in CVE-2025-2573 is insufficient input sanitization and output escaping.
- collector/mitre-cve
- source/MITRE
- collector/nvd-api
- source/NVD
- agent/severity
- agent/title
- agent/author
- agent/references
- agent/source
- agent/event
- agent/last-modified-date
- agent/weakness
- agent/type
- agent/description
- agent/first-publish-date
- agent/softwarecombine
- agent/tags
- agent/guess-ai
- agent/software-canonical-lookup
- vendor/amazing service box
- canonical/amazing service box addons for wpbakery page builder