{"id":"CVE-2026-81812","state":"PUBLISHED","title":"Elementor < 4.3.5 - Author+ Stored XSS via SVG Upload","description":"The Elementor Website Builder  WordPress plugin before 4.3.5 does not sanitize uploaded SVG files on every upload route, allowing users with the Author role and above to upload a file containing JavaScript, which will run in the browser of any user who opens it. Exploitation requires unfiltered file uploads to be enabled in the Elementor Website Builder  WordPress plugin before 4.3.5 settings, which is not the default.","publishedAt":"2026-10-21T06:00:24.247Z","updatedAt":"2026-10-21T10:35:02.313Z","severity":{"score":6.4,"label":"Medium","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:H","source":"CISA-ADP"},"assigner":"WPScan","products":["Unknown Elementor Website Builder"],"affected":[{"vendor":"Unknown","product":"Elementor Website Builder","defaultStatus":"unaffected","versions":[{"version":"0","status":"affected","lessThan":"4.3.5","versionType":"semver"}]}],"references":["https://wpscan.com/vulnerability/ba550282-d354-4d39-95c6-c4820a91f270/"],"weaknesses":["CWE-79"],"ingestedAt":"2026-10-29T20:13:15.269Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2026/81xxx/CVE-2026-81812.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2026-81812","state":"PUBLISHED","datePublished":"2026-10-21T06:00:24.247Z","dateUpdated":"2026-10-21T10:35:02.313Z","assignerShortName":"WPScan","assignerOrgId":"1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81","dateReserved":"2026-08-27T12:40:30.561Z"},"containers":{"cna":{"title":"Elementor < 4.3.5 - Author+ Stored XSS via SVG Upload","descriptions":[{"lang":"en","value":"The Elementor Website Builder  WordPress plugin before 4.3.5 does not sanitize uploaded SVG files on every upload route, allowing users with the Author role and above to upload a file containing JavaScript, which will run in the browser of any user who opens it. Exploitation requires unfiltered file uploads to be enabled in the Elementor Website Builder  WordPress plugin before 4.3.5 settings, which is not the default."}],"affected":[{"vendor":"Unknown","product":"Elementor Website Builder","defaultStatus":"unaffected","versions":[{"version":"0","status":"affected","lessThan":"4.3.5","versionType":"semver"}]}],"references":[{"url":"https://wpscan.com/vulnerability/ba550282-d354-4d39-95c6-c4820a91f270/","tags":["exploit","vdb-entry","technical-description"]}],"problemTypes":[{"descriptions":[{"description":"CWE-79 Cross-Site Scripting (XSS)","lang":"en","type":"CWE"}]}],"providerMetadata":{"shortName":"WPScan","orgId":"1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81","dateUpdated":"2026-10-21T06:00:24.247Z"},"credits":[{"lang":"en","value":"NGUYỄN ĐỨC HÒA","type":"finder"},{"lang":"en","value":"WPScan","type":"coordinator"}],"source":{"discovery":"EXTERNAL"},"x_generator":{"engine":"WPScan CVE Generator"}},"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":6.4,"attackVector":"NETWORK","baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:H","integrityImpact":"HIGH","userInteraction":"REQUIRED","attackComplexity":"HIGH","availabilityImpact":"HIGH","privilegesRequired":"HIGH","confidentialityImpact":"HIGH"}},{"other":{"type":"ssvc","content":{"id":"CVE-2026-81812","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"total"}],"version":"2.0.3","timestamp":"2026-10-21T10:16:51.813363Z"}}}],"problemTypes":[{"descriptions":[{"cweId":"CWE-79","lang":"en","type":"CWE","description":"CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')"}]}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2026-10-21T10:35:02.313Z"}}]}}}