PT-2025-48269 · WordPress · Unlimited Elements For Elementor

0Xvenus + 2 · Published 2025-11-27 · Updated 2025-11-27 · CVE-2025-13692

Positive Technologies (AI Summary)

CVSS v3.1

7.2

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Unlimited Elements For Elementor plugin for WordPress versions prior to 2.1

Description The Unlimited Elements For Elementor plugin for WordPress is susceptible to Stored Cross-Site Scripting through SVG File uploads. Insufficient input sanitization and output escaping allow unauthenticated attackers to inject arbitrary web scripts into pages when a user accesses the SVG file. Exploitation requires a form with a file upload field created using the premium version of the plugin, but the issue remains exploitable even after deactivation or uninstallation of the premium version.

Recommendations Update to version 2.1 or later.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2025-13692

Affected Products

Unlimited Elements For Elementor

References · 12

• https://nvd.nist.gov/vuln/detail/CVE-2025-13692 · Security Note
• https://plugins.trac.wordpress.org/browser/unlimited-elements-for-elementor/trunk/inc_php/unitecreator_form.class.php#L598 · Note
• https://t.me/CVEtracker/38391 · Telegram Post
• https://plugins.trac.wordpress.org/browser/unlimited-elements-for-elementor/trunk/inc_php/unitecreator_form.class.php#L1952 · Note
• https://plugins.trac.wordpress.org/browser/unlimited-elements-for-elementor/trunk/inc_php/unitecreator_form.class.php#L1960 · Note
• https://twitter.com/VulmonFeeds/status/1994054787348787332 · Twitter Post
• https://t.me/cveNotify/144188 · Telegram Post
• https://twitter.com/CVEnew/status/1994047731086594071 · Twitter Post
• https://plugins.trac.wordpress.org/browser/unlimited-elements-for-elementor/trunk/inc_php/unitecreator_filters_process.class.php#L3279 · Note
• https://unlimited-elements.com/change-log · Note
• https://wordfence.com/threat-intel/vulnerabilities/id/ae603b13-dc09-4f83-8741-943d62615b3c?source=cve · Note
• https://plugins.trac.wordpress.org/changeset/3403331 · Note