CVE-2025-4963
Description
The WP Extended plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up to, and including, 3.0.15 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Author-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses the SVG file.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Authenticated authors can upload malicious SVGs in WP Extended ≤3.0.15, leading to stored XSS that executes when other users view the file.
The WP Extended plugin for WordPress, in all versions up to and including 3.0.15, contains a stored cross-site scripting (XSS) vulnerability in its SVG File Upload module. The module aims to provide secure SVG uploads by validating files, sanitizing content, and limiting file size [1]. However, the sanitization logic is insufficient, allowing attackers to inject arbitrary JavaScript or other web scripts into SVG files that bypass the intended security filters [description].
AI Insight generated on May 20, 2026. Synthesized from this CVE's description and the cited reference URLs; citations are validated against the source bundle.
Affected products
1Patches
0No patches discovered yet.
Vulnerability mechanics
AI mechanics synthesis has not run for this CVE yet.
References
4News mentions
0No linked articles in our index yet.