CVE-2025-13692
📋 TL;DR
The Unlimited Elements For Elementor WordPress plugin allows unauthenticated attackers to upload malicious SVG files containing JavaScript that executes when viewed. This stored XSS vulnerability affects all WordPress sites using plugin versions up to 2.0. Attackers can hijack user sessions, deface websites, or redirect users to malicious sites.
💻 Affected Systems
- Unlimited Elements For Elementor WordPress Plugin
⚠️ Manual Verification Required
This CVE does not have specific version information in our database, so automatic vulnerability detection cannot determine if your system is affected.
Why? The CVE database entry doesn't specify which versions are vulnerable (no version ranges provided by the vendor/NVD).
🔒 Custom verification scripts are available for registered users. Sign up free to download automated test scripts.
- Review the CVE details at NVD
- Check vendor security advisories for your specific version
- Test if the vulnerability is exploitable in your environment
- Consider updating to the latest version as a precaution
⚠️ Risk & Real-World Impact
Worst Case
Complete site takeover through session hijacking of administrators, credential theft, malware distribution to visitors, and persistent website defacement.
Likely Case
Session hijacking of logged-in users, website defacement, and redirection to phishing/malware sites affecting site visitors.
If Mitigated
Limited impact to non-sensitive user sessions with proper content security policies and file upload restrictions in place.
🎯 Exploit Status
Attack requires uploading SVG file with embedded JavaScript payload. No authentication needed once vulnerable form exists.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 2.0.1 or later
Vendor Advisory: https://wordpress.org/plugins/unlimited-elements-for-elementor/#developers
Restart Required: No
Instructions:
1. Log into WordPress admin panel. 2. Navigate to Plugins → Installed Plugins. 3. Find 'Unlimited Elements For Elementor'. 4. Click 'Update Now' if update available. 5. If no update, manually download version 2.0.1+ from WordPress.org and replace plugin files.
🔧 Temporary Workarounds
Disable SVG Uploads
allBlock SVG file uploads through WordPress functions or .htaccess rules
Add to functions.php: add_filter('upload_mimes', function($mimes) { unset($mimes['svg']); return $mimes; });
Content Security Policy
allImplement CSP headers to block inline script execution
Add to .htaccess: Header set Content-Security-Policy "default-src 'self'; script-src 'self'"
Or use WordPress CSP plugin
🧯 If You Can't Patch
- Disable or uninstall the Unlimited Elements For Elementor plugin completely
- Implement web application firewall rules to block SVG uploads and sanitize file uploads
🔍 How to Verify
Check if Vulnerable:
Check WordPress admin → Plugins → Unlimited Elements For Elementor → Version number. If version is 2.0 or lower, you are vulnerable.Check Version:
wp plugin list --name='unlimited-elements-for-elementor' --field=version (WP-CLI) or check WordPress admin plugins pageVerify Fix Applied:
Verify plugin version is 2.0.1 or higher. Test SVG upload functionality to ensure scripts are properly sanitized.📡 Detection & Monitoring
Log Indicators:
- Unusual SVG file uploads in WordPress media logs
- Multiple failed/successful SVG upload attempts from single IP
- POST requests to /wp-content/uploads/ with SVG files
Network Indicators:
- HTTP POST requests with SVG file uploads to WordPress endpoints
- Unusual traffic to uploaded SVG files
SIEM Query:
source="wordpress" AND (uri_path="*svg" OR file_type="svg") AND http_method="POST"🔗 References
- https://plugins.trac.wordpress.org/browser/unlimited-elements-for-elementor/trunk/inc_php/unitecreator_filters_process.class.php#L3279
- https://plugins.trac.wordpress.org/browser/unlimited-elements-for-elementor/trunk/inc_php/unitecreator_form.class.php#L1952
- https://plugins.trac.wordpress.org/browser/unlimited-elements-for-elementor/trunk/inc_php/unitecreator_form.class.php#L1960
- https://plugins.trac.wordpress.org/browser/unlimited-elements-for-elementor/trunk/inc_php/unitecreator_form.class.php#L598
- https://plugins.trac.wordpress.org/changeset/3403331/
- https://unlimited-elements.com/change-log/
- https://www.wordfence.com/threat-intel/vulnerabilities/id/ae603b13-dc09-4f83-8741-943d62615b3c?source=cve
