CVE-2025-9703: 
WordPress vulnerability analysis and mitigation

The Ultimate Addons for Elementor (Formerly Elementor Header & Footer Builder) WordPress plugin before version 2.5.0 contains a Cross-Site Scripting vulnerability. The vulnerability was discovered on September 15, 2025, and affects the plugin's handling of SVG file contents when uploaded through the xmlrpc.php endpoint using base64 encode (WPScan, NVD).

The vulnerability stems from improper sanitization of SVG file contents when they are uploaded through the xmlrpc.php endpoint using base64 encoding. The CVSS score has been assessed as 4.3 (MEDIUM) by CISA-ADP with the vector string CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:L/I:L/A:L, indicating a network-accessible vulnerability requiring high privileges and user interaction (NVD).

The vulnerability allows for Cross-Site Scripting (XSS) attacks, which could potentially lead to unauthorized script execution in the context of other users' browsers. This is classified under the OWASP Top 10 category A7: Cross-Site Scripting (XSS) and is identified as CWE-79 (WPScan).

The vulnerability has been fixed in version 2.5.0 of the Ultimate Addons for Elementor plugin. Users are advised to update to this version or later to mitigate the security risk (WPScan).