CVE-2025-9698

MediumCVSS 6.8/10Last modified Oct 8, 2026

Description

The Plus Addons for Elementor WordPress plugin before 6.3.16 does not sanitize SVG file contents, which could allow users with minimum role access as Author to perform Stored Cross-Site Scripting attacks.

Metrics

CVSS 3.1 6.8/10CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H

Affected software

No affected versions have been published.

Timeline

Published: Oct 13, 2025
Last modified: Oct 8, 2026
NVD status: Deferred

Related CVEs from 2025

CVE-2025-96999.8A vulnerability was detected in SourceCodester Online Polling System Code 1.0. This vulnerability affects unknown code of the file /admin/ch CVE-2025-97009.8A flaw has been found in SourceCodester Online Book Store 1.0. This issue affects some unknown processing of the file /publisher_list.php. T CVE-2025-97019.8A vulnerability was determined in SourceCodester Simple Cafe Billing System 1.0. The impacted element is an unknown function of the file /re CVE-2025-97029.8A vulnerability was identified in SourceCodester Simple Cafe Billing System 1.0. This affects an unknown function of the file /sales_report.CVE-2025-97034.3The Ultimate Addons for Elementor (Formerly Elementor Header & Footer Builder) WordPress plugin before 2.5.0 does not sanitize SVG file cont CVE-2025-97049.8A security flaw has been discovered in SourceCodester Water Billing System 1.0. This impacts an unknown function of the file /viewbill.php. CVE-2025-97059.8A weakness has been identified in SourceCodester Water Billing System 1.0. Affected is an unknown function of the file /paybill.php. This ma CVE-2025-97069.8A security vulnerability has been detected in SourceCodester Water Billing System 1.0. Affected by this vulnerability is an unknown function CVE-2025-97086.8A vulnerability exists in the Kubernetes C# client where the certificate validation logic accepts properly constructed certificates from any CVE-2025-97098.6On-Chip Debug and Test Interface With Improper Access Control and Improper Protection against Electromagnetic Fault Injection (EM-FI) in Nor CVE-2025-97106.3The Responsive Lightbox & Gallery WordPress plugin before 2.5.3 does not properly handle HTML tag attributes modifications, potentially allo CVE-2025-97117.8A vulnerability in Brocade Fabric OS before 9.2.1c3 could allow elevating the privileges of the local authenticated user to “root” using the