What’s Vulnerable › Vulnerabilities
CVE-2026-81812: Elementor < 4.3.5 - Author+ Stored XSS via SVG Upload
- Severity: medium (CVSS 6.4 v3.1)
- Exploited in the wild: not listed in CISA KEV
- EPSS: 0.3% probability of exploitation in the next 30 days
- Public exploit or detection template: none known
- Published: 2026-10-21 · updated 2026-10-21
- Weakness: CWE-79
Description
The Elementor Website Builder WordPress plugin before 4.3.5 does not sanitize uploaded SVG files on every upload route, allowing users with the Author role and above to upload a file containing JavaScript, which will run in the browser of any user who opens it. Exploitation requires unfiltered file uploads to be enabled in the Elementor Website Builder WordPress plugin before 4.3.5 settings, which is not the default.
Affected products
- Elementor Website Builder: before 4.3.5 — fixed in 4.3.5
How to fix
Upgrade to a fixed version: Elementor Website Builder 4.3.5. Check the vendor advisory for mitigations.
References
Get alerted when CVE-2026-81812 or the next vulnerability affects your stack