CVE-2025-2575 is a stored cross-site scripting vulnerability in the Z Companion plugin for WordPress, affecting all versions up to and including 1.1.1. The vulnerability allows authenticated users with Author-level access or above to upload SVG files containing malicious scripts due to inadequate sanitization and escaping of input and output. These scripts execute when any user accesses the SVG file, potentially leading to script execution in the context of the affected site. Exploitation requires the Royal Shop theme to be active, which is a prerequisite for the vulnerability to be triggered.

Successful exploitation allows an authenticated user with Author-level permissions or higher to inject and execute arbitrary web scripts in the context of the vulnerable WordPress site. This can lead to partial compromise of confidentiality and integrity (CVSS impact: low confidentiality and integrity impact, no availability impact). The vulnerability does not allow unauthenticated attackers to exploit it and requires a specific theme to be installed.

No official patch or fix is currently available for this vulnerability. Users should monitor the vendor's advisory channels for updates. Until a fix is released, restrict Author-level user permissions where possible and avoid installing or using the Royal Shop theme with the Z Companion plugin. Consider disabling SVG file uploads or implementing additional input validation and output escaping controls at the application or web server level to mitigate risk.