Stored Cross-Site Scripting Vulnerability in Your Simple SVG Support Plugin for WordPress

CVE-2025-2542

What is CVE-2025-2542?

The Your Simple SVG Support plugin for WordPress is vulnerable to a Stored Cross-Site Scripting (XSS) attack through SVG file uploads. This vulnerability arises from inadequate input sanitization and output escaping, allowing authenticated attackers with Author-level access or higher to introduce unauthorized web scripts into the application. When users access the compromised SVG file, the injected scripts can be executed, leading to potential security breaches and unauthorized actions within the affected WordPress installations.

References