CVE-2026-81812 — MEDIUM (6.4)

Vulnerability Description

The Elementor Website Builder WordPress plugin before 4.3.5 does not sanitize uploaded SVG files on every upload route, allowing users with the Author role and above to upload a file containing JavaScript, which will run in the browser of any user who opens it. Exploitation requires unfiltered file uploads to be enabled in the Elementor Website Builder WordPress plugin before 4.3.5 settings, which is not the default.

CVSS Score

6.4

MEDIUM

CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:H

Attack Vector

NETWORK

Attack Complexity

HIGH

Privileges Required

HIGH

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality

HIGH

Integrity

HIGH

Availability

HIGH

Related Weaknesses (CWE)

CWE-79

References

https://wpscan.com/vulnerability/ba550282-d354-4d39-95c6-c4820a91f270/

FAQ

What is CVE-2026-81812?

CVE-2026-81812 is a vulnerability with a CVSS score of 6.4 (MEDIUM). The Elementor Website Builder WordPress plugin before 4.3.5 does not sanitize uploaded SVG files on every upload route, allowing users with the Author role and above to upload a file containing JavaS...

How severe is CVE-2026-81812?

CVE-2026-81812 has been rated MEDIUM with a CVSS base score of 6.4/10. Review the CVSS metrics above for detailed severity breakdown.

Is there a patch for CVE-2026-81812?

Check the references section above for vendor advisories and patch information. Review vendor security bulletins for remediation guidance.