CVE-2026-81812mediumCWE-79

CVE-2026-81812: medium-severity vulnerability in Elementor Website Builder

Elementor < 4.3.5 - Author+ Stored XSS via SVG Upload

Published

Follow this CVE+ Monitor Elementor Website Builder

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

33Vexday Risk Score

No sign of exploitation. It has a public proof of concept.

ssvc Attendcvss 6.4epss 0.3%
The Elementor Website Builder WordPress plugin before 4.3.5 does not sanitize uploaded SVG files on every upload route, allowing users with the Author role and above to upload a file containing JavaScript, which will run in the browser of any user who opens it. Exploitation requires unfiltered file uploads to be enabled in the Elementor Website Builder WordPress plugin before 4.3.5 settings, which is not the default.
CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:H
Affected products
Unknown · Elementor Website Builder
⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.
Related CVEs — Elementor Website Builder

In the same product, most dangerous first.

CVE-2021-24891—Elementor < 3.4.8 - DOM Cross-Site-ScriptingEPSS 28.9%CVE-2023-0329HIGHElementor Website Builder < 3.12.2 - Admin+ SQLiEPSS 19.7%CVE-2022-4953—Elementor < 3.5.5 - Iframe InjectionEPSS 3.4%CVE-2021-24205—Elementor < 3.1.2 - Authenticated Stored Cross-Site Scripting (XSS) in Icon Box WidgetEPSS 0.8%CVE-2021-24204—Elementor < 3.1.2 - Authenticated Stored Cross-Site Scripting (XSS) in Accordion WidgetEPSS 0.7%CVE-2021-24201—Elementor < 3.1.2 - Authenticated Stored Cross-Site Scripting (XSS) in Column ElementEPSS 0.7%