CVE-2026-81812: CWE-79 Cross-Site Scripting (XSS) in Elementor Website Builder
Description
The Elementor Website Builder WordPress plugin before 4.3.5 does not sanitize uploaded SVG files on every upload route, allowing users with the Author role and above to upload a file containing JavaScript, which will run in the browser of any user who opens it. Exploitation requires unfiltered file uploads to be enabled in the Elementor Website Builder WordPress plugin before 4.3.5 settings, which is not the default.
CVSS v3.1
Score 6.4medium
Affected software
Elementor Website Builder
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The Elementor Website Builder WordPress plugin versions prior to 4.3.5 have a CWE-79 Cross-Site Scripting vulnerability due to insufficient sanitization of SVG file uploads. Users with Author role or above can upload SVG files containing malicious JavaScript code. This code executes in the context of any user who views the uploaded SVG file. However, exploitation depends on the unfiltered file uploads setting being enabled, which is disabled by default. No CVSS score is provided, and no known exploits are reported in the wild.
Potential Impact
If exploited, this vulnerability allows users with Author role or higher to execute arbitrary JavaScript in the browsers of users who view the malicious SVG files. This could lead to session hijacking, defacement, or other client-side attacks. However, the risk is mitigated by the requirement that unfiltered file uploads be enabled, which is not the default setting.
Mitigation Recommendations
Upgrade the Elementor Website Builder plugin to version 4.3.5 or later where this issue is fixed. If upgrading is not immediately possible, ensure that the unfiltered file uploads setting remains disabled to prevent exploitation. Monitor plugin settings to avoid enabling unfiltered uploads inadvertently.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- WPScan
- Date Reserved
- 2026-08-27T12:40:30.561Z
- State
- PUBLISHED
Threat ID: 6ad855df2cdf04f656afec34
Added to database: 10/21/2026, 06:04:15 UTC
Last enriched: 10/21/2026, 06:19:15 UTC
Last updated: 10/21/2026, 13:40:20 UTC
Views: 7
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
External Links
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.