CVE-2025-9703 — Ultimate Addons for Elementor Lite < 2.5.0 - Author+ Stored XSS

CVE-2025-9703

Ultimate Addons for Elementor Lite < 2.5.0 - Author+ Stored XSS PUBLISHED

Description (CNA)

The Ultimate Addons for Elementor (Formerly Elementor Header & Footer Builder) WordPress plugin before 2.5.0 does not sanitize SVG file contents when uploaded through the xmlrpc.php endpoint using base64 encode, leading to a Cross-Site Scripting vulnerability.

Affected (CNA)

Vendor / product	Versions
Unknown / Ultimate Addons for Elementor (Formerly Elementor Header & Footer Builder)	affected 0 before 2.5.0

CWE

No CWE identifiers supplied.

References

https://wpscan.com/vulnerability/4332d49b-d58c-4728-afab-6757ff9e43ee/

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.