6.8
Medium
CVE-2025-9698 The Plus Addons for Elementor WordPress plugin before 6.3.16 does not sanitize SVG file contents, which could allow…
Description
The Plus Addons for Elementor WordPress plugin before 6.3.16 does not sanitize SVG file contents, which could allow users with minimum role access as Author to perform Stored Cross-Site Scripting attacks.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| The Plus Addons for Elementor 6.3 | earliest → < 6.3.16 | 6.3.16 |