Stored Cross-Site Scripting in WP Project Manager Plugin by WeDevs
CVE-2025-3100
6.4MEDIUM
Key Information:
- Vendor
WordPress
- Vendor
- CVE Published:
- 9 April 2025
What is CVE-2025-3100?
The WP Project Manager plugin, developed by WeDevs, is susceptible to Stored Cross-Site Scripting due to inadequate sanitization and output escaping processes during the handling of SVG file uploads. This vulnerability allows authenticated attackers with Subscriber-level access or higher to inject malicious scripts into web pages. When a user accesses an SVG file, the injected scripts may execute, leading to potential data compromise or unauthorized actions within the WordPress site.
Affected Version(s)
WP Project Manager – Task, team, and project management plugin featuring kanban board and gantt charts * <= 2.6.22