Live › vulnerability › CVE-2026-81813
Go to dashboardThe Elementor Website Builder WordPress plugin before 4.3.5 does not sanitize text content inside uploaded SVG files, checking only elements and attributes. A user with the Contributor role or higher can store an SVG whose payload runs in the browser of anyone who views it when the SVG is rendered inline in a page, in Chromium-based browsers.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
WordPress sites running the Elementor Website Builder plugin before 4.3.5 where users with the Contributor role or higher can upload SVG files that are rendered inline on pages. Visitors using Chromium-based browsers are the ones at risk; Firefox is not affected. Sites on a patched version or without the plugin can skip it.
No product ranges from the sources yet.
wp plugin get elementor --field=version, and compare it with 4.3.5.4.3.5 or later.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
The Elementor Website Builder WordPress plugin before 4.3.5 does not sanitize the text content of SVG files, checking only their elements and attributes, allowing users with the Contributor role and above to store a payload which breaks out when the SVG is rendered inline in a page and executes in the browser of any user viewing it. Execution is specific to Chromium-based browsers; Firefox is not affected.
This page as .md · .json · in your agent: get_signal("CVE-2026-81813")
NVD data is provided by NIST and is public domain · EPSS scores by FIRST, used with attribution. Posts quoted belong to their authors.