CVE-2026-81812mediumCWE-79

CVE-2026-81812: fallo de gravedad media en Elementor Website Builder

Elementor < 4.3.5 - Author+ Stored XSS via SVG Upload

Publicada el

Seguir esta CVE+ Monitorear Elementor Website Builder

Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.

33Vexday Risk Score

Sin señal de explotación. Ella tiene prueba de concepto pública.

ssvc Attendcvss 6.4epss 0.3%
The Elementor Website Builder WordPress plugin before 4.3.5 does not sanitize uploaded SVG files on every upload route, allowing users with the Author role and above to upload a file containing JavaScript, which will run in the browser of any user who opens it. Exploitation requires unfiltered file uploads to be enabled in the Elementor Website Builder WordPress plugin before 4.3.5 settings, which is not the default.
CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:H
Productos afectados
Unknown · Elementor Website Builder
⚠ Recursos públicos, para evaluar la exposición de sistemas que controlas o estás autorizado a probar. Prueba solo con autorización.
CVEs relacionadas — Elementor Website Builder

En el mismo producto, de las más peligrosas a las menos.

CVE-2021-24891—Elementor < 3.4.8 - DOM Cross-Site-ScriptingEPSS 28.9%CVE-2023-0329HIGHElementor Website Builder < 3.12.2 - Admin+ SQLiEPSS 19.7%CVE-2022-4953—Elementor < 3.5.5 - Iframe InjectionEPSS 3.4%CVE-2021-24205—Elementor < 3.1.2 - Authenticated Stored Cross-Site Scripting (XSS) in Icon Box WidgetEPSS 0.8%CVE-2021-24204—Elementor < 3.1.2 - Authenticated Stored Cross-Site Scripting (XSS) in Accordion WidgetEPSS 0.7%CVE-2021-24201—Elementor < 3.1.2 - Authenticated Stored Cross-Site Scripting (XSS) in Column ElementEPSS 0.7%