CVE-2026-81813: Elementor < 4.3.5 - Contributor+ Stored XSS via SVG CDATA Sanitizer Bypass
The Elementor Website Builder WordPress plugin before 4.3.5 does not sanitize the text content of SVG files, checking only their elements and attributes, allowing users with the Contributor role and above to store a payload which breaks out when the SVG is rendered inline in a page and executes in the browser of any user viewing it. Execution is specific to Chromium-based browsers; Firefox is not affected.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue, and who is exposed to the payload?
A user with the Contributor role or higher can store a malicious SVG payload. It executes in the browser of any user who views a page where the SVG is rendered inline, but only in Chromium-based browsers; Firefox is not affected.
What condition is required for exploitation?
The attacker must be able to submit an SVG whose text content contains the payload and have it rendered inline on a page. The bypass relies on the plugin checking SVG elements and attributes without sanitizing SVG text content.
Which versions require remediation?
Elementor Website Builder versions before 4.3.5 are affected. Updating to version 4.3.5 or later addresses the affected version range.