WP Project Manager Stored Cross-Site Scripting Vulnerability via SVG Upload

A stored cross-site scripting vulnerability has been identified in the WP Project Manager plugin for WordPress, affecting all versions through 2.6.22. This vulnerability arises from inadequate input sanitization and output escaping, allowing authenticated attackers with Author-level access or higher to inject arbitrary scripts into pages. The injected scripts execute when a user accesses the SVG file.

Impact

Exploitation of this vulnerability allows for stored cross-site scripting, where injected scripts are executed in the context of the user viewing the SVG file.

Reproduction

To reproduce this vulnerability, an authenticated user with Author-level access can upload an SVG file containing malicious scripts. The absence of proper sanitization allows the scripts to be executed when the SVG file is accessed.

Remediation

Users are advised to update the WP Project Manager plugin to version 2.6.23 or later.