CVE-2025-2513 is a stored cross-site scripting vulnerability in the Smart Icons For WordPress plugin affecting all versions up to 1.0.4. The issue stems from improper neutralization of input during web page generation, specifically insufficient sanitization and escaping of SVG file uploads. Authenticated users with Editor-level or higher privileges can upload crafted SVG files containing malicious scripts that execute in the context of users viewing those SVGs. This vulnerability can lead to limited confidentiality and integrity impacts but does not affect availability. The CVSS 3.1 vector is AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N, reflecting network attack vector, low attack complexity, required privileges, no user interaction, scope change, and partial confidentiality and integrity impact.

Successful exploitation allows an authenticated user with Editor or higher privileges to inject and store malicious scripts via SVG uploads. These scripts execute in the browsers of users who view the SVG files, potentially leading to theft of session tokens, defacement, or other script-based attacks. The impact is limited to confidentiality and integrity with no availability impact. There is no evidence of active exploitation in the wild.

No official patch or fix is currently available for this vulnerability. Users should monitor the vendor's advisory channels for updates. As a temporary mitigation, restrict SVG file uploads to trusted users only and consider disabling SVG uploads if not required. Implement additional input validation or sanitization at the application or web server level if possible. Review user privileges to limit Editor-level access to trusted personnel until a fix is released.