Stored Cross-Site Scripting Vulnerability in Unlimited Elements For Elementor Plugin

CVE-2025-13692

What is CVE-2025-13692?

The Unlimited Elements For Elementor plugin is susceptible to Stored Cross-Site Scripting due to improper input sanitization and output escaping during SVG file uploads. This vulnerability allows unauthenticated attackers to embed malicious scripts which will be executed when users access the compromised SVG files. The exploit requires a file upload form created in the plugin's premium version; however, the vulnerability persists even if the premium version is deactivated or uninstalled, allowing sustained exposure if the form remains accessible.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch →

References