Cross-site Scripting Vulnerability in weDevs WP Project Manager Plugin
CVE-2025-22649

4.8MEDIUM

Key Information:

Vendor

WordPress
Status
WP Project Manager
Vendor
CVE Published:
27 March 2025

What is CVE-2025-22649?

A Cross-site Scripting (XSS) vulnerability has been identified in the weDevs WP Project Manager plugin that allows attackers to inject malicious scripts into web pages viewed by users. This vulnerability affects versions from n/a up to and including 2.6.22, enabling the potential for stored XSS attacks, where the malicious script is stored on the server and executed in the context of the user's browser. Administrators using the affected versions are advised to apply security patches to mitigate the risks associated with this vulnerability.

Affected Version(s)

WP Project Manager <= 2.6.22

References

https://patchstack.com/database/wordpress/plugin/wedevs-p...
vdb-entry

CVSS V3.1

Score:
4.8
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
High
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Manab Jyoti Dowarah (Patchstack Alliance)
JSON
.