Skip to main content

CVE-2025-9703

Medium
4.3/10

Summary

The Ultimate Addons for Elementor (Formerly Elementor Header & Footer Builder) WordPress plugin before 2.5.0 does not sanitize SVG file contents when uploaded through the xmlrpc.php endpoint using base64 encode, leading to a Cross-Site Scripting vulnerability.

  • LOW
  • NETWORK
  • LOW
  • UNCHANGED
  • REQUIRED
  • HIGH
  • LOW
  • LOW

References

Advisory Timeline

  • Published