TLDRVuln - Cybersecurity Vulnerabilities Made Simple

CVE-2025-9703

Medium · published October 6, 2025

CVSS v3.1

4.3

EPSS

Percentile

6.9

In the wild

Unconfirmed

What it is

The Ultimate Addons for Elementor (Formerly Elementor Header & Footer Builder) WordPress plugin before 2.5.0 does not sanitize SVG file contents when uploaded through the xmlrpc.php endpoint using base64 encode, leading to a Cross-Site Scripting vulnerability.

The record

Technical detail

CVSS v3.1: 4.3 · MEDIUM
Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:L/I:L/A:L
CVSS v4.0: Not supplied
EPSS: 0.00177 · 6.9th percentile
Published: 2025-10-06T10:15Z

References (1)

https://wpscan.com/vulnerability/4332d49b-d58c-4728-afab-6757ff9e43ee/ · [email protected]

EPSS history

Timeline

06 OCT 06:00Z
Ultimate Addons for Elementor Lite < 2.5.0 - Author+ Stored XSS
cvelistv5