Stored Cross-Site Scripting in WP Project Manager Plugin by WeDevs
CVE-2025-3100

5.4MEDIUM

Key Information:

Vendor

WordPress
Status
WP Project Manager – Task, Team, And Project Management Plugin Featuring Kanban Board And Gantt Charts
Vendor
CVE Published:
9 April 2025

What is CVE-2025-3100?

The WP Project Manager plugin, developed by WeDevs, is susceptible to Stored Cross-Site Scripting due to inadequate sanitization and output escaping processes during the handling of SVG file uploads. This vulnerability allows authenticated attackers with Subscriber-level access or higher to inject malicious scripts into web pages. When a user accesses an SVG file, the injected scripts may execute, leading to potential data compromise or unauthorized actions within the WordPress site.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch

Affected Version(s)

WP Project Manager – Task, team, and project management plugin featuring kanban board and gantt charts * <= 2.6.22

References

https://www.wordfence.com/threat-intel/vulnerabilities/id...
https://plugins.trac.wordpress.org/browser/wedevs-project...
https://plugins.trac.wordpress.org/changeset/3268509/wede...

CVSS V3.1

Score:
5.4
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Siavash Vaez Afshar
JSON
.