CVE-2026-81812— Elementor < 4.3.5 - Author+ Stored XSS via SVG Upload

Quick assessment

Affected

Unknown Elementor Website Builder

Exploitation

No confirmed in-the-wild exploitation; assess based on exposure

Recommended action

Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Elementor Website Builder WordPress 插件在 4.3.5 版本之前，未在所有上传路径中对上传的 SVG 文件进行清理（sanitization），导致拥有“作者”（Author）角色及更高权限的用户能够上传包含 JavaScript 代码的文件。该脚本将在任何打开该文件的用户的浏览器中执行。利用此漏洞需要满足一个前提条件：在 4.3.5 版本之前的 Elementor Website Builder 插件设置中启用了“未过滤文件上传”（unfiltered file uploads

AI Predicted 6.5 Difficulty: Moderate EPSS 0.28% · P20 Updated Oct 21, 2026

Possible ATT&CK Techniques 2 AI

T1566 · Phishing T1190 · Exploit Public-Facing Application

Affected Version Matrix 1

Vendor	Product	Version Range	Status
Unknown	Elementor Website Builder	`< 4.3.5`	affected

Get alerts for future matching vulnerabilities Log in to subscribe

Vulnerability Information

Have questions about the vulnerability? See if Shenlong's analysis helps!

View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title

Elementor < 4.3.5 - Author+ Stored XSS via SVG Upload

Source: CVE Program / CVE List V5

Vulnerability Description

The Elementor Website Builder WordPress plugin before 4.3.5 does not sanitize uploaded SVG files on every upload route, allowing users with the Author role and above to upload a file containing JavaScript, which will run in the browser of any user who opens it. Exploitation requires unfiltered file uploads to be enabled in the Elementor Website Builder WordPress plugin before 4.3.5 settings, which is not the default.

Source: CVE Program / CVE List V5

CVSS Information

N/A

Source: CVE Program / CVE List V5

Vulnerability Type

N/A

Source: CVE Program / CVE List V5

Affected Products

Vendor	Product	Affected Versions	CPE	Subscribe
Unknown	Elementor Website Builder	0 ~ 4.3.5	-

II. Public POCs for CVE-2026-81812

#	POC Description	Source Link	Shenlong Link

AI-Generated POC Premium

No public POC found.

III. Intelligence Information for CVE-2026-81812

请登录查看更多情报信息。

https://www.cve.org/CVERecord?id=CVE-2026-81812

Same Patch Batch · Unknown · 2026-10-21 · 53 CVEs total

CVE-2026-85683	8.8 HIGH	Jane Menu < 1.5.1 - Unauthenticated Stored XSS via Store Config Proxy URL
CVE-2026-14556	5.4 MEDIUM	HappyForms < 1.26.15 - Unauthenticated HTML Injection in Admin Notification Email via clie
CVE-2026-107447	5.3 MEDIUM	Contest Gallery < 34.0.1 - Unauthenticated Vote Restriction Bypass via Spoofable Client-IP
CVE-2026-105256	5.3 MEDIUM	LatePoint < 5.7.5 - Unauthenticated Payment Bypass via 'payment_portion' Parameter
CVE-2026-104641	5.3 MEDIUM	Simple Shopping Cart < 5.3.3 - Unauthenticated Payment Bypass via Unverified PayPal IPN Re
CVE-2026-103301	5.3 MEDIUM	Payment Gateway for Telcell < 2.0.5 - Unauthenticated Payment Confirmation Forgery via Emp
CVE-2026-101138	5.3 MEDIUM	CMP - Coming Soon & Maintenance 4.1.19 - 4.1.20 - Unauthenticated Maintenance Mode Bypass
CVE-2026-104642	2.7 LOW	Simple Shopping Cart 5.1.3 - 5.3.2 - Contributor+ Price Manipulation via Price Verificatio
CVE-2026-105257		LatePoint < 5.7.5 - Agent+ Customer PII Disclosure via IDOR
CVE-2026-110514		WPZOOM Portfolio < 1.4.34 - Contributor+ Arbitrary Post/Page Type Overwrite via IDOR
CVE-2026-107127		Uncanny Toolkit for LearnDash < 3.8.2 - Account Takeover via Password Reset CSRF
CVE-2026-107128		Uncanny Toolkit for LearnDash < 3.8.2 - Admin+ Cross-Site Account Lockout via Missing Auth
CVE-2026-107788		SmartyParcel (WC Ukr Shipping) < 1.23.4 - Subscriber+ Arbitrary Shipping Label Deletion
CVE-2026-107790		WP Job Openings < 4.1.1 - Author+ Stored XSS via Job Title
CVE-2026-107789		SmartyParcel < 1.23.4 - Unauthenticated Shipping Label Disclosure via IDOR
CVE-2026-108073		SureCart < 4.9.5 - Unauthenticated Private Catalog Data Disclosure via 'expand' Parameter
CVE-2026-109147		WP Booking System < 2.1.0.3 - Reflected XSS via 'booking_id' Parameter
CVE-2026-109926		Productive Commerce < 1.1.49 - Subscriber+ Arbitrary Plugin Activation
CVE-2026-110523		WP User Manager 2.9.21 - 2.9.25 - Unauthenticated Privilege Escalation via Paid Registrati
CVE-2026-100145		Synchrony Financing 1.0.5 - 1.1.1 - Unauthenticated Order Takeover via admin_order_callbac

Showing top 20 of 53 CVEs. View all on vendor page → →

IV. Related Vulnerabilities

Same product: Elementor Website Builder

Same vendor: Unknown