Stored Cross-Site Scripting Vulnerability in AI Content Pipelines Plugin for WordPress
CVE-2025-2544
6.4MEDIUM
Key Information:
- Vendor
WordPress
- Vendor
- CVE Published:
- 5 April 2025
What is CVE-2025-2544?
The AI Content Pipelines plugin for WordPress is susceptible to Stored Cross-Site Scripting attacks through SVG file uploads. This vulnerability arises due to inadequate input sanitization and output escaping in versions up to and including 1.6. Consequently, authenticated attackers with Author-level access can inject arbitrary web scripts into pages accessed by users, leading to potential manipulation of content and unauthorized actions when users interact with the SVG files.
Affected Version(s)
AI Content Pipelines: Content Engine + Analytics * <= 1.6