CVE-2025-2573 is a stored cross-site scripting vulnerability (CWE-79) in the Amazing service box Addons For WPBakery Page Builder WordPress plugin. The issue occurs due to improper neutralization of input during web page generation, specifically via SVG file uploads. Authenticated attackers with Author-level privileges or higher can upload crafted SVG files containing malicious scripts that execute when accessed by users. This vulnerability affects all versions up to 2.0.0. The CVSS 3.1 vector indicates network attack vector, low attack complexity, privileges required at the low level, no user interaction, scope changed, and low impact on confidentiality and integrity, with no impact on availability.

An attacker with Author-level access or higher can exploit this vulnerability to inject and execute arbitrary scripts in the context of users viewing the SVG files. This can lead to information disclosure and integrity impacts within the affected WordPress environment. There is no direct impact on system availability. The vulnerability could facilitate further attacks such as session hijacking or privilege escalation if combined with other vulnerabilities.

Patch status is not yet confirmed — no official fix or patch information is currently available. Until a vendor advisory or patch is released, it is recommended to restrict Author-level user permissions to trusted users only and avoid uploading SVG files from untrusted sources. Monitor official vendor channels for updates and apply patches promptly once available.