CVE-2025-9703
MediumCVSS 4.3Exploitation Probability (EPSS)
Low risk7th percentile - higher than 7% of all known CVEs
Summary
The Ultimate Addons for Elementor (Formerly Elementor Header & Footer Builder) WordPress plugin before 2.5.0 does not sanitize SVG file contents when uploaded through the xmlrpc.php endpoint using base64 encode, leading to a Cross-Site Scripting vulnerability.
Risk Assessment
The organization may be exposed to malicious script execution in the user's browser, potentially leading to session theft, data compromise, or further attacks.
Recommendation
Immediately update the plugin to version 2.5.0 or later and implement server-side validation of SVG file contents.
Other vulnerabilities in Ultimate Addons for Elementor
See all- CVE-2026-66688Medium
XSS vulnerability in Ultimate Addons for Elementor versions up to 1.45.2 allows a user with Contributor role to inject malicious script.
- CVE-2026-15787Medium
The Ultimate Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Navigation Menu Widget data-toggle-icon/data-close-icon Attributes in all versions up to, and including, 2.9.1 due to insufficient input sanitization and output escaping. This allows authenticated attackers with contributor-level access or above to inject arbitrary web scripts that execute when a user accesses an injected page.
Original NVD description (English source)
The Ultimate Addons for Elementor (Formerly Elementor Header & Footer Builder) WordPress plugin before 2.5.0 does not sanitize SVG file contents when uploaded through the xmlrpc.php endpoint using base64 encode, leading to a Cross-Site Scripting vulnerability.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS