CVE-2026-81813

The Elementor Website Builder WordPress plugin, in versions before 4.3.5 , is vulnerable to a Stored Cross-Site Scripting (XSS) flaw. The root cause is an insufficient sanitizer that fails to scrub the text content of SVG files, focusing only on elements and attributes. This allows users with Con...

CVE-2026-81813 Elementor < 4.3.5 - Contributor+ Stored XSS via SVG CDATA Sanitizer Bypass

The Elementor Website Builder WordPress plugin before 4.3.5 does not sanitize the text content of SVG files, checking only their elements and attributes, allowing users with the Contributor role and above to store a payload which breaks out when the SVG is rendered inline in a page and executes i...