Stored Cross-Site Scripting Vulnerability in Your Simple SVG Support Plugin for WordPress

CVE-2025-2542

What is CVE-2025-2542?

The Your Simple SVG Support plugin for WordPress is vulnerable to a Stored Cross-Site Scripting (XSS) attack through SVG file uploads. This vulnerability arises from inadequate input sanitization and output escaping, allowing authenticated attackers with Author-level access or higher to introduce unauthorized web scripts into the application. When users access the compromised SVG file, the injected scripts can be executed, leading to potential security breaches and unauthorized actions within the affected WordPress installations.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch →

References