CVE-2026-81813
Elementor < 4.3.5 - Contributor+ Stored XSS via SVG CDATA Sanitizer Bypass
Unknown Elementor Website Builder
CVSS
6.8MediumExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)0.32%Chance of exploitation activity in the next 30 days, higher than 23% of CVEs. Scored 23 Oct 2026FIRST EPSS
What fixes it
- 4.3.5Elementor Website BuilderCVE List
A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.
Description
The Elementor Website Builder WordPress plugin before 4.3.5 does not sanitize the text content of SVG files, checking only their elements and attributes, allowing users with the Contributor role and above to store a payload which breaks out when the SVG is rendered inline in a page and executes in the browser of any user viewing it. Execution is specific to Chromium-based browsers; Firefox is not affected.
Text from CVE List
Affected versions 1
- Elementor Website Builderaffected: all versions before 4.3.5CVE List