CVE-2026-81812: Elementor < 4.3.5 - Author+ Stored XSS via SVG Upload
The Elementor Website Builder WordPress plugin before 4.3.5 does not sanitize uploaded SVG files on every upload route, allowing users with the Author role and above to upload a file containing JavaScript, which will run in the browser of any user who opens it. Exploitation requires unfiltered file uploads to be enabled in the Elementor Website Builder WordPress plugin before 4.3.5 settings, which is not the default.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Elementor Website Builder WordPress pluginto a version that resolves this vulnerability.Fixed in 4.3.5
Event History
Frequently Asked Questions
Who can exploit this issue?
A user with the Author role or a higher-privileged role can exploit it by uploading an SVG file containing JavaScript. The script runs when another user opens the uploaded SVG in a browser.
Are default Elementor configurations affected?
No. Exploitation requires unfiltered file uploads to be enabled in Elementor settings, and this setting is not enabled by default.
What should be done if updating is not immediately possible?
Disable unfiltered file uploads in Elementor settings. Restrict Author-level and higher accounts from uploading SVG files until the plugin can be updated.