---
id: "CVE-2026-81813"
kind: "vulnerability"
aliases: ["CVE-2026-81813"]
title: "Elementor WordPress plugin: SVG text lets contributors run scripts"
severity: "medium"
cvss: 6.8
epss: 0.00317
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["elementor", "package", "self-hosted", "wordpress"]
not_affected_if: ["firefox-only-visitors", "no-contributor-accounts", "patched-version"]
published_at: "2026-10-21T06:16:49+00:00"
first_seen_at: "2026-10-23T21:57:28+00:00"
updated_at: "2026-10-25T03:42:57+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-81813", "first_seen_at": "2026-10-23T21:57:28+00:00"}, {"source": "epss", "url": "https://api.first.org/data/v1/epss?cve=CVE-2026-81813", "first_seen_at": "2026-10-24T13:15:54+00:00"}]
---

# Elementor WordPress plugin: SVG text lets contributors run scripts

The Elementor Website Builder WordPress plugin before 4.3.5 does not sanitize text content inside uploaded SVG files, checking only elements and attributes. A user with the Contributor role or higher can store an SVG whose payload runs in the browser of anyone who views it when the SVG is rendered inline in a page, in Chromium-based browsers.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed Elementor plugin version in the WordPress admin Plugins screen or with `wp plugin get elementor --field=version`, and compare it with `4.3.5`.
- Review whether Contributor-level or higher accounts can upload SVG files, which the sources do not detail further.

## Fix

- Update the Elementor Website Builder plugin to `4.3.5` or later.
- Until updated, restrict SVG uploads or inline SVG rendering for Contributor and higher roles, which the sources do not specify.

## Timeline

- 2026-10-23T21:57:28+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-81813
- 2026-10-24T13:15:54+00:00 epss https://api.first.org/data/v1/epss?cve=CVE-2026-81813

## From the sources

The Elementor Website Builder  WordPress plugin before 4.3.5 does not sanitize the text content of SVG files, checking only their elements and attributes, allowing users with the Contributor role and above to store a payload which breaks out when the SVG is rendered inline in a page and executes in the browser of any user viewing it. Execution is specific to Chromium-based browsers; Firefox is not affected.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_