CVE-2025-9703
Medium
Description
The Ultimate Addons for Elementor (Formerly Elementor Header & Footer Builder) WordPress plugin before 2.5.0 does not sanitize SVG file contents when uploaded through the xmlrpc.php endpoint using base64 encode, leading to a Cross-Site Scripting vulnerability.
SeverityMedium
CVSS4.3
Exploit probability—
ProductUltimate Addons for Elementor (Formerly Elementor Header & Footer Builder)
PublishedOct 6, 2025
First seenOct 6, 2025
Weakness typeCWE-79Cross-site scripting (XSS)
How to fix
Update
- Ultimate Addons for Elementor (Formerly Elementor Header & Footer Builder)2.5.0 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| Ultimate Addons for Elementor (Formerly Elementor Header & Footer Builder) | v < 2.5.0 | 2.5.0 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.