Stored Cross-Site Scripting Vulnerability in Z Companion Plugin for WordPress

CVE-2025-2575

What is CVE-2025-2575?

The Z Companion plugin for WordPress contains a vulnerability that allows authenticated users with author-level access and above to exploit stored cross-site scripting (XSS) through SVG file uploads. This vulnerability arises from the lack of proper input sanitization and output escaping, enabling attackers to inject malicious web scripts that will execute whenever a user accesses the affected SVG file. The vulnerability specifically requires the Royal Shop theme to be installed to facilitate the exploit, raising concerns about the overall security of WordPress sites utilizing this plugin.

References