CVE-2025-9698
MediumCVSS 6.8Exploitation Probability (EPSS)
Low risk22th percentile - higher than 22% of all known CVEs
Summary
The Plus Addons for Elementor WordPress plugin before 6.3.16 does not sanitize SVG file contents, which could allow users with minimum role access as Author to perform Stored Cross-Site Scripting attacks.
Risk Assessment
An attacker with Author privileges can inject malicious code into SVG files, which will execute in other users' browsers, leading to session theft or other attacks. This can compromise the security of the entire WordPress site.
Recommendation
Update the Plus Addons for Elementor plugin to version 6.3.16 or later. Consider restricting SVG file upload capabilities for low-privilege users.
Other vulnerabilities in Plus Addons for Elementor
See all- CVE-2026-15285Medium
The Plus Addons for Elementor plugin for WordPress up to version 6.4.11 is vulnerable to Authenticated (Contributor+) Stored Cross-Site Scripting via the Button widget's `custom_attributes` setting. The `render` function passes the raw string through `tp_senitize_js_input()`, which is bypassable.
- CVE-2026-9243Medium
The Plus Addons for Elementor plugin for WordPress up to version 6.4.15 contains a stored XSS vulnerability via the 'carousel_direction' parameter in the Carousel Anything widget. Insufficient output escaping in the render() function allows HTML attribute injection, enabling authenticated attackers (contributor-level and above) to inject arbitrary scripts.
Original NVD description (English source)
The Plus Addons for Elementor WordPress plugin before 6.3.16 does not sanitize SVG file contents, which could allow users with minimum role access as Author to perform Stored Cross-Site Scripting attacks.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS