{"id":"CVE-2026-81813","kind":"vulnerability","aliases":["CVE-2026-81813"],"related":[],"title":"Elementor WordPress plugin: SVG text lets contributors run scripts","description":"The Elementor Website Builder  WordPress plugin before 4.3.5 does not sanitize the text content of SVG files, checking only their elements and attributes, allowing users with the Contributor role and above to store a payload which breaks out when the SVG is rendered inline in a page and executes in the browser of any user viewing it. Execution is specific to Chromium-based browsers; Firefox is not affected.","summary":"The Elementor Website Builder WordPress plugin before 4.3.5 does not sanitize text content inside uploaded SVG files, checking only elements and attributes. A user with the Contributor role or higher can store an SVG whose payload runs in the browser of anyone who views it when the SVG is rendered inline in a page, in Chromium-based browsers.","severity":"medium","cvss":6.8,"epss":0.00317,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["elementor","package","self-hosted","wordpress"],"not_affected_if":["firefox-only-visitors","no-contributor-accounts","patched-version"],"how_to_check":"- Check the installed Elementor plugin version in the WordPress admin Plugins screen or with `wp plugin get elementor --field=version`, and compare it with `4.3.5`.\n- Review whether Contributor-level or higher accounts can upload SVG files, which the sources do not detail further.","fix":"- Update the Elementor Website Builder plugin to `4.3.5` or later.\n- Until updated, restrict SVG uploads or inline SVG rendering for Contributor and higher roles, which the sources do not specify.","status":"open","published_at":"2026-10-21T06:16:49+00:00","first_seen_at":"2026-10-23T21:57:28+00:00","triaged_at":"2026-10-25T03:42:57+00:00","updated_at":"2026-10-25T03:42:57+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-10-25T03:42:57Z","model":"claude-haiku-5-5","output":{"fix":"- Update the Elementor Website Builder plugin to `4.3.5` or later.\n- Until updated, restrict SVG uploads or inline SVG rendering for Contributor and higher roles, which the sources do not specify.","reach":"internet","title":"Elementor WordPress plugin: SVG text lets contributors run scripts","impact":"medium","summary":"The Elementor Website Builder WordPress plugin before 4.3.5 does not sanitize text content inside uploaded SVG files, checking only elements and attributes. A user with the Contributor role or higher can store an SVG whose payload runs in the browser of anyone who views it when the SVG is rendered inline in a page, in Chromium-based browsers.","category":"package","nicknames":[],"who_cares":["wordpress","elementor","self-hosted"],"confidence":0.7,"needs_auth":"yes","worst_case":"Scripts run in visitors' browsers, exposing their sessions on the site.","analyst_note":"","how_to_check":"- Check the installed Elementor plugin version in the WordPress admin Plugins screen or with `wp plugin get elementor --field=version`, and compare it with `4.3.5`.\n- Review whether Contributor-level or higher accounts can upload SVG files, which the sources do not detail further.","needs_analyst":false,"not_affected_if":["patched-version","no-contributor-accounts","firefox-only-visitors"],"who_is_affected":"WordPress sites running the Elementor Website Builder plugin before 4.3.5 where users with the Contributor role or higher can upload SVG files that are rendered inline on pages. Visitors using Chromium-based browsers are the ones at risk; Firefox is not affected. Sites on a patched version or without the plugin can skip it.","user_interaction":"yes","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.00066,"input_tokens":3391,"output_tokens":642,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-2026':11A,14A '-81813':12A,15A '4.3.5':29B,88C 'affect':149C 'allow':104C 'anyon':63B 'attribut':43B,103C 'base':79B,144C 'break':117C 'browser':61B,80B,132C,145C 'builder':25B,84C 'check':39B,98C 'chromium':78B,143C 'chromium-bas':77B,142C 'content':34B,94C 'contributor':7A,48B,108C 'cve':10A,13A 'element':41B,101C 'elementor':1A,16B,23B,82C 'execut':129C,138C 'file':38B,97C 'firefox':146C 'higher':51B 'host':20B 'inlin':72B,124C 'insid':35B 'let':6A 'packag':17B 'page':75B,127C 'payload':57B,115C 'plugin':3A,27B,86C 'render':71B,123C 'role':49B,109C 'run':8A,58B 'sanit':32B,91C 'script':9A 'self':19B 'self-host':18B 'specif':140C 'store':53B,113C 'svg':4A,37B,55B,69B,96C,121C 'text':5A,33B,93C 'upload':36B 'user':45B,105C,135C 'view':65B,136C 'websit':24B,83C 'whose':56B 'wordpress':2A,21B,26B,85C","nicknames":[],"mitigations":[],"who_affected":"WordPress sites running the Elementor Website Builder plugin before 4.3.5 where users with the Contributor role or higher can upload SVG files that are rendered inline on pages. Visitors using Chromium-based browsers are the ones at risk; Firefox is not affected. Sites on a patched version or without the plugin can skip it.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-21T06:16:49+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H","cvss_by":"134c704f-9b21-4f2e-91b3-4a467353bcc0","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-81813","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-81813","severity":null,"published_at":"2026-10-21T06:16:49+00:00","modified_at":"2026-10-21T18:37:38+00:00","first_seen_at":"2026-10-23T21:57:28+00:00","fetched_at":"2026-10-23T22:29:01+00:00","note":null},{"source":"epss","external_id":"CVE-2026-81813","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-81813","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-24T13:15:54+00:00","fetched_at":"2026-10-24T13:15:54+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}