Medium severity · published Oct 21, 2026
CVE-2026-81813
Elementor < 4.3.5 - Contributor+ Stored XSS via SVG CDATA Sanitizer Bypass
6.8
CVSS
0.4%
EPSS
No
On KEV
Description
The Elementor Website Builder WordPress plugin before 4.3.5 does not sanitize the text content of SVG files, checking only their elements and attributes, allowing users with the Contributor role and above to store a payload which breaks out when the SVG is rendered inline in a page and executes in the browser of any user viewing it. Execution is specific to Chromium-based browsers; Firefox is not affected.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
High
User interaction
Required
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.4% · higher than 35% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
EW
Elementor Website Builder ·
before 4.3.5 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-81813
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-81813
wpscan.com
https://wpscan.com/vulnerability/d7c6f47b-feda-4fba-99a3-af3a7c9c8417/
More from Elementor Website Builder
7.2
CVE-2023-0329
Elementor Website Builder < 3.12.2 - Admin+ SQLi
6.4
CVE-2026-81812
Elementor < 4.3.5 - Author+ Stored XSS via SVG Upload
6.1
CVE-2022-4953
Elementor < 3.5.5 - Iframe Injection
4.9
CVE-2026-8825
Elementor < 4.1.4 - Contributor+ Sensitive Information Disclosure via REST API