Threat Investigation
Request a demo

CVE-2025-9698

Medium

Description

The Plus Addons for Elementor WordPress plugin before 6.3.16 does not sanitize SVG file contents, which could allow users with minimum role access as Author to perform Stored Cross-Site Scripting attacks.

SeverityMedium
CVSS6.8
Exploit probability—
ProductThe Plus Addons for Elementor
PublishedOct 13, 2025
First seenOct 13, 2025
Weakness typeCWE-79Cross-site scripting (XSS)

How to fix

Update
  • The Plus Addons for Elementor6.3.16 or later

Affected products

ProductAffected versionsFixed in
The Plus Addons for Elementorv < 6.3.166.3.16

Check your version

Choose the product and enter the version you run to see whether it falls in the affected range.

In the Intelligence 360 plan

Attack Surface Management

See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.