CVE-2025-3100: WP Project Manager – Task, team, and project management plugin featuring kanban board and gantt charts <= 2.6.22 - Authenticated (Subscriber+) Stored Cross-Site Scripting via SVG File Upload
First published: Wed Apr 09 2025(Updated: )
The WP Project Manager – Task, team, and project management plugin featuring kanban board and gantt charts plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up to, and including, 2.6.22 due to insufficient input sanitization and output escaping in tasks discussion. This makes it possible for authenticated attackers, with Subscriber-level access and above, and permissions granted by an Administrator, to inject arbitrary web scripts in pages that will execute whenever a user accesses the SVG file.
Credit: security@wordfence.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| WP Project Manager | <=2.6.22 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://www.wordfence.com/threat-intel/vulnerabilities/id/4d62b087-b0ca-4fa8-921b-5eeb3fa76596?source=cve
- https://plugins.trac.wordpress.org/browser/wedevs-project-manager/trunk/src/File/Helper/File.php#L56
- https://plugins.trac.wordpress.org/changeset/3268509/wedevs-project-manager/trunk/bootstrap/loaders.php
Frequently Asked Questions
What is the severity of CVE-2025-3100?
CVE-2025-3100 has a severity rating due to its potential to allow Stored Cross-Site Scripting attacks.
How do I fix CVE-2025-3100?
To fix CVE-2025-3100, update the WP Project Manager plugin to version 2.6.23 or later where the vulnerability is addressed.
Which versions of WP Project Manager are affected by CVE-2025-3100?
CVE-2025-3100 affects all versions of WP Project Manager up to and including version 2.6.22.
What types of attacks can CVE-2025-3100 facilitate?
CVE-2025-3100 can facilitate Stored Cross-Site Scripting attacks through insecure handling of SVG file uploads.
Is user input properly sanitized in CVE-2025-3100?
No, CVE-2025-3100 is caused by insufficient input sanitization of SVG file uploads.
- collector/mitre-cve
- source/MITRE
- agent/weakness
- agent/references
- agent/title
- agent/type
- agent/description
- agent/first-publish-date
- agent/guess-ai
- agent/software-canonical-lookup
- agent/softwarecombine
- collector/nvd-api
- source/NVD
- agent/severity
- agent/last-modified-date
- agent/author
- agent/event
- collector/epss-latest
- source/FIRST
- agent/source
- agent/tags
- agent/epss
- vendor/wp project manager
- canonical/wp project manager