CVE-2025-2576 is a stored cross-site scripting vulnerability in the Ayyash Studio — The kick-start kit WordPress plugin (versions up to 1.0.3). The issue occurs due to improper neutralization of input during web page generation, specifically insufficient sanitization and escaping of SVG file uploads. Authenticated attackers with Author-level access or higher can upload crafted SVG files containing malicious scripts. These scripts execute in the context of users viewing the SVG files, potentially leading to session hijacking or other script-based attacks. The vulnerability has a CVSS 3.1 score of 6.4, reflecting medium severity with network attack vector, low attack complexity, and privileges required.

Successful exploitation allows an authenticated user with Author-level or higher privileges to inject and store malicious scripts via SVG uploads. These scripts execute when other users access the SVG files, potentially compromising user sessions or performing unauthorized actions within the affected WordPress site. The impact is limited to confidentiality and integrity with no direct availability impact. The vulnerability requires authentication and is not exploitable by unauthenticated attackers.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict Author-level and higher user permissions to trusted users only and consider disabling SVG uploads if possible. Monitor for plugin updates from themerox and apply official patches promptly once available.