{"id":"CVE-2026-81812","kind":"vulnerability","aliases":["CVE-2026-81812"],"related":[],"title":"Elementor WordPress plugin: uploaded SVG files can run JavaScript in browsers","description":"The Elementor Website Builder  WordPress plugin before 4.3.5 does not sanitize uploaded SVG files on every upload route, allowing users with the Author role and above to upload a file containing JavaScript, which will run in the browser of any user who opens it. Exploitation requires unfiltered file uploads to be enabled in the Elementor Website Builder  WordPress plugin before 4.3.5 settings, which is not the default.","summary":"The Elementor Website Builder WordPress plugin before 4.3.5 does not sanitize SVG files on every upload route. An author-level user can upload an SVG containing JavaScript that runs in the browser of anyone who opens it, which is a stored cross-site scripting issue.","severity":"medium","cvss":6.4,"epss":0.00213,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["elementor","package","self-hosted","wordpress"],"not_affected_if":["auth-required","default-config","patched-version"],"how_to_check":"- Check the installed Elementor version in the WordPress admin plugins list or with `wp plugin get elementor --field=version`\n- Check whether unfiltered file uploads are enabled in the Elementor settings (the setting is named in the advisory; exact location unknown)","fix":"- Update the Elementor Website Builder plugin to `4.3.5` or later\n- Disable unfiltered file uploads in the Elementor settings if you do not need them","status":"open","published_at":"2026-10-21T06:16:49+00:00","first_seen_at":"2026-10-23T21:57:28+00:00","triaged_at":"2026-10-25T03:59:21+00:00","updated_at":"2026-10-25T03:59:21+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-10-25T03:59:21Z","model":"claude-haiku-5-5","output":{"fix":"- Update the Elementor Website Builder plugin to `4.3.5` or later\n- Disable unfiltered file uploads in the Elementor settings if you do not need them","reach":"internet","title":"Elementor WordPress plugin: uploaded SVG files can run JavaScript in browsers","impact":"medium","summary":"The Elementor Website Builder WordPress plugin before 4.3.5 does not sanitize SVG files on every upload route. An author-level user can upload an SVG containing JavaScript that runs in the browser of anyone who opens it, which is a stored cross-site scripting issue.","category":"package","nicknames":[],"who_cares":["wordpress","elementor","self-hosted"],"confidence":0.7,"needs_auth":"yes","worst_case":"Stored XSS runs script in visitors' and admins' browsers","analyst_note":"","how_to_check":"- Check the installed Elementor version in the WordPress admin plugins list or with `wp plugin get elementor --field=version`\n- Check whether unfiltered file uploads are enabled in the Elementor settings (the setting is named in the advisory; exact location unknown)","needs_analyst":false,"not_affected_if":["default-config","patched-version","auth-required"],"who_is_affected":"Sites running the Elementor Website Builder plugin before 4.3.5 where unfiltered file uploads are enabled. Exploitation needs an Author-level account or higher. Sites on 4.3.5 or later, or with unfiltered uploads left at the default off, are not exposed.","user_interaction":"yes","needs_special_setup":"yes","severity_if_unknown":"medium"},"cost_usd":0.000624,"input_tokens":3406,"output_tokens":566,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-2026':13A,16A '-81812':14A,17A '4.3.5':31B,78C,131C 'allow':89C 'anyon':58B 'author':43B,93C 'author-level':42B 'browser':11A,56B,108C 'builder':27B,74C,127C 'contain':50B,101C 'cross':67B 'cross-sit':66B 'cve':12A,15A 'default':137C 'elementor':1A,18B,25B,72C,125C 'enabl':122C 'everi':38B,86C 'exploit':115C 'file':6A,36B,84C,100C,118C 'host':22B 'issu':70B 'javascript':9A,51B,102C 'level':44B 'open':60B,113C 'packag':19B 'plugin':3A,29B,76C,129C 'requir':116C 'role':94C 'rout':40B,88C 'run':8A,53B,105C 'sanit':34B,81C 'script':69B 'self':21B 'self-host':20B 'set':132C 'site':68B 'store':65B 'svg':5A,35B,49B,83C 'unfilt':117C 'upload':4A,39B,47B,82C,87C,98C,119C 'user':45B,90C,111C 'websit':26B,73C,126C 'wordpress':2A,23B,28B,75C,128C","nicknames":[],"mitigations":[],"who_affected":"Sites running the Elementor Website Builder plugin before 4.3.5 where unfiltered file uploads are enabled. Exploitation needs an Author-level account or higher. Sites on 4.3.5 or later, or with unfiltered uploads left at the default off, are not exposed.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-21T06:16:49+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:H","cvss_by":"134c704f-9b21-4f2e-91b3-4a467353bcc0","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-81812","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-81812","severity":null,"published_at":"2026-10-21T06:16:49+00:00","modified_at":"2026-10-21T18:37:38+00:00","first_seen_at":"2026-10-23T21:57:28+00:00","fetched_at":"2026-10-23T22:29:01+00:00","note":null},{"source":"epss","external_id":"CVE-2026-81812","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-81812","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-24T13:15:54+00:00","fetched_at":"2026-10-24T13:15:54+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}