Stored Cross-Site Scripting Vulnerability in Unlimited Elements For Elementor Plugin

CVE-2025-13692

What is CVE-2025-13692?

The Unlimited Elements For Elementor plugin is susceptible to Stored Cross-Site Scripting due to improper input sanitization and output escaping during SVG file uploads. This vulnerability allows unauthenticated attackers to embed malicious scripts which will be executed when users access the compromised SVG files. The exploit requires a file upload form created in the plugin's premium version; however, the vulnerability persists even if the premium version is deactivated or uninstalled, allowing sustained exposure if the form remains accessible.

References