CVE-2026-81812: Elementor Website Builder XSS Vulnerability

CVE-2026-81812 Overview

CVE-2026-81812 is a stored cross-site scripting (XSS) vulnerability in the Elementor Website Builder WordPress plugin prior to version 4.3.5. The plugin fails to sanitize uploaded Scalable Vector Graphics (SVG) files on every upload route. Authenticated users with the Author role or above can upload an SVG containing JavaScript, which executes in the browser of any user who later opens the file. Exploitation requires the non-default Unfiltered File Uploads setting to be enabled within the plugin configuration. The weakness is tracked under CWE-79.

Critical Impact
Authenticated contributors can plant persistent JavaScript payloads that execute against administrators and site visitors, enabling session theft and administrative action hijacking.

Affected Products

Elementor Website Builder WordPress plugin versions prior to 4.3.5
WordPress sites with the plugin's Unfiltered File Uploads option enabled
Sites that provision Author, Editor, or Administrator roles to untrusted contributors

Discovery Timeline

2026-10-21 - CVE-2026-81812 published to the National Vulnerability Database (NVD)
2026-10-21 - Last updated in NVD database

Technical Details for CVE-2026-81812

Vulnerability Analysis

The Elementor Website Builder plugin exposes multiple file upload routes used for media library ingestion and page builder asset handling. One or more of these routes omit the SVG sanitization pass that strips embedded script elements, event handlers, and foreign objects. An attacker uploads a crafted SVG whose XML payload contains a <script> tag or an on-event attribute. When a victim loads the SVG directly in a browser, the embedded JavaScript executes within the WordPress site origin.

Because the payload runs with the victim's session, the attacker can read authenticated cookies accessible to script, call the WordPress REST API as the victim, pivot to administrator takeover, or inject additional persistence through plugin and theme editors.

Root Cause

The root cause is inconsistent input sanitization across upload handlers. SVG is an XML format that supports executable content, so safe handling requires every ingestion path to invoke a sanitizer that removes <script>, <foreignObject>, event attributes, and external references. The vulnerable release applies this sanitization selectively, leaving at least one upload route exposed when Unfiltered File Uploads is enabled.

Attack Vector

Exploitation is network-based but requires high privileges and user interaction. The attacker must hold Author or higher within WordPress, and a site administrator must have enabled the non-default unfiltered uploads setting. The attacker uploads a malicious SVG through the vulnerable Elementor route and then entices a victim, typically an administrator reviewing user content, to open the file. The script executes in the victim's browser context and can perform any action the victim is authorized to perform.

No verified exploit code is publicly available. The vulnerability mechanism is documented in the WPScan Vulnerability Report.

Detection Methods for CVE-2026-81812

Indicators of Compromise

Uploaded .svg files in wp-content/uploads/ containing <script> tags, onload=, onclick=, or <foreignObject> elements
New or modified WordPress administrator accounts created shortly after an SVG upload by a lower-privileged user
Outbound requests from administrator browser sessions to attacker-controlled domains following media library access

Detection Strategies

Scan the uploads directory for SVG files and inspect their XML content for executable constructs using tools such as grep -R "<script\|on[a-z]*=" wp-content/uploads/
Review WordPress audit logs for Author-role file uploads of SVG MIME types followed by administrator sessions opening those assets
Correlate web server access logs for direct SVG requests from authenticated administrator IP addresses

Monitoring Recommendations

Alert on changes to the Elementor Unfiltered File Uploads setting through configuration monitoring of wp_options
Monitor WordPress REST API calls originating from browser contexts shortly after SVG asset loads for signs of session-riding activity
Baseline user-role assignments and alert on unexpected elevation to Administrator following media interactions

How to Mitigate CVE-2026-81812

Immediate Actions Required

Upgrade the Elementor Website Builder plugin to version 4.3.5 or later on all WordPress installations
Disable the Unfiltered File Uploads option within Elementor settings unless strictly required
Audit existing SVG files in the media library and remove any that contain scripts or event handler attributes
Review Author, Editor, and Administrator role assignments and revoke access for untrusted accounts

Patch Information

The vendor addressed the issue in Elementor Website Builder version 4.3.5 by extending SVG sanitization to the affected upload routes. Refer to the WPScan Vulnerability Report for advisory tracking.

Workarounds

Keep the Elementor Unfiltered File Uploads setting disabled, which blocks the exploitation precondition
Deploy a web application firewall rule that rejects SVG uploads containing <script>, <foreignObject>, or on*= attributes
Serve uploaded SVG files with Content-Disposition: attachment or from a sandboxed origin to prevent script execution against the primary site

bash

# Disable SVG execution via Apache response header for uploads
<FilesMatch "\.svg$">
  Header set Content-Security-Policy "script-src 'none'; object-src 'none'"
  Header set Content-Disposition "attachment"
</FilesMatch>