CVE-2025-9698

The Plus Addons for Elementor < 6.3.16 - Author+ Stored XSS

The Plus Addons for Elementor WordPress plugin before 6.3.16 does not sanitize SVG file contents, which could allow users with minimum role access as Author to perform Stored Cross-Site Scripting attacks.

Affected

The Plus Addons for Elementor

CVSS v3.1 CNA

6.8 MEDIUMCVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H

EPSS

0.31% chance of exploitation in the next 30 days, 22nd percentile

Published

2025-10-13

Updated

2025-10-14

Proof-of-concept exploits (1)

• https://wpscan.com/vulnerability/a9539def-d92b-4117-b36a-17015c578d89/

References

• CVE Record
• NVD entry