Live › vulnerability › CVE-2026-81812
Go to dashboardThe Elementor Website Builder WordPress plugin before 4.3.5 does not sanitize SVG files on every upload route. An author-level user can upload an SVG containing JavaScript that runs in the browser of anyone who opens it, which is a stored cross-site scripting issue.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Sites running the Elementor Website Builder plugin before 4.3.5 where unfiltered file uploads are enabled. Exploitation needs an Author-level account or higher. Sites on 4.3.5 or later, or with unfiltered uploads left at the default off, are not exposed.
No product ranges from the sources yet.
wp plugin get elementor --field=version4.3.5 or laterEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
The Elementor Website Builder WordPress plugin before 4.3.5 does not sanitize uploaded SVG files on every upload route, allowing users with the Author role and above to upload a file containing JavaScript, which will run in the browser of any user who opens it. Exploitation requires unfiltered file uploads to be enabled in the Elementor Website Builder WordPress plugin before 4.3.5 settings, which is not the default.
This page as .md · .json · in your agent: get_signal("CVE-2026-81812")
NVD data is provided by NIST and is public domain · EPSS scores by FIRST, used with attribution. Posts quoted belong to their authors.