The WordPress plugin WP Project Manager is vulnerable to stored XSS because SVG file uploads are not properly sanitized and output escaped when submitted in tasks discussion. An authenticated user with Subscriber level or higher, with permissions granted by an Administrator, can inject arbitrary JavaScript that will execute in the browser of any user who opens the malicious SVG file, potentially leaking cookies or hijacking sessions.

All installations of the WP Project Manager plugin for WordPress up to and including version 2.6.22, developed by WeDevs under the name Project Manager – AI Powered Project Management, Task Management, Kanban Board & Time Tracker.

The CVSS v3 score of 6.4 indicates moderate severity, and the EPSS score of less than 1% shows a low current exploitation probability. The vulnerability is not listed in the CISA KEV catalog. The attack vector requires an authenticated user at Subscriber level or above; after uploading a crafted SVG file the script runs automatically when any user views the file, spreading the exploit to all site visitors.