---
id: "CVE-2026-81812"
kind: "vulnerability"
aliases: ["CVE-2026-81812"]
title: "Elementor WordPress plugin: uploaded SVG files can run JavaScript in browsers"
severity: "medium"
cvss: 6.4
epss: 0.00213
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["elementor", "package", "self-hosted", "wordpress"]
not_affected_if: ["auth-required", "default-config", "patched-version"]
published_at: "2026-10-21T06:16:49+00:00"
first_seen_at: "2026-10-23T21:57:28+00:00"
updated_at: "2026-10-25T03:59:21+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-81812", "first_seen_at": "2026-10-23T21:57:28+00:00"}, {"source": "epss", "url": "https://api.first.org/data/v1/epss?cve=CVE-2026-81812", "first_seen_at": "2026-10-24T13:15:54+00:00"}]
---

# Elementor WordPress plugin: uploaded SVG files can run JavaScript in browsers

The Elementor Website Builder WordPress plugin before 4.3.5 does not sanitize SVG files on every upload route. An author-level user can upload an SVG containing JavaScript that runs in the browser of anyone who opens it, which is a stored cross-site scripting issue.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed Elementor version in the WordPress admin plugins list or with `wp plugin get elementor --field=version`
- Check whether unfiltered file uploads are enabled in the Elementor settings (the setting is named in the advisory; exact location unknown)

## Fix

- Update the Elementor Website Builder plugin to `4.3.5` or later
- Disable unfiltered file uploads in the Elementor settings if you do not need them

## Timeline

- 2026-10-23T21:57:28+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-81812
- 2026-10-24T13:15:54+00:00 epss https://api.first.org/data/v1/epss?cve=CVE-2026-81812

## From the sources

The Elementor Website Builder  WordPress plugin before 4.3.5 does not sanitize uploaded SVG files on every upload route, allowing users with the Author role and above to upload a file containing JavaScript, which will run in the browser of any user who opens it. Exploitation requires unfiltered file uploads to be enabled in the Elementor Website Builder  WordPress plugin before 4.3.5 settings, which is not the default.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_