Medium severity · published Oct 21, 2026
CVE-2026-81812
Elementor < 4.3.5 - Author+ Stored XSS via SVG Upload
6.4
CVSS
0.3%
EPSS
No
On KEV
Description
The Elementor Website Builder WordPress plugin before 4.3.5 does not sanitize uploaded SVG files on every upload route, allowing users with the Author role and above to upload a file containing JavaScript, which will run in the browser of any user who opens it. Exploitation requires unfiltered file uploads to be enabled in the Elementor Website Builder WordPress plugin before 4.3.5 settings, which is not the default.
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
High
Privileges
High
User interaction
Required
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.3% · higher than 20% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
EW
Elementor Website Builder ·
before 4.3.5 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-81812
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-81812
wpscan.com
https://wpscan.com/vulnerability/ba550282-d354-4d39-95c6-c4820a91f270/
More from Elementor Website Builder
7.2
CVE-2023-0329
Elementor Website Builder < 3.12.2 - Admin+ SQLi
6.8
CVE-2026-81813
Elementor < 4.3.5 - Contributor+ Stored XSS via SVG CDATA Sanitizer Bypass
6.1
CVE-2022-4953
Elementor < 3.5.5 - Iframe Injection
4.9
CVE-2026-8825
Elementor < 4.1.4 - Contributor+ Sensitive Information Disclosure via REST API