6.8
Medium
CVE-2025-9978 The Jeg Kit for Elementor WordPress plugin before 2.7.0 does not sanitize SVG file contents when uploaded via…
Description
The Jeg Kit for Elementor WordPress plugin before 2.7.0 does not sanitize SVG file contents when uploaded via xmlrpc.php, leading to a cross site scripting vulnerability.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| Jeg Kit for Elementor 2.7 | earliest → < 2.7.0 | 2.7.0 |