CVE-2026-81812

MediumCVSS 6.4/10Last modified Oct 21, 2026

Description

The Elementor Website Builder WordPress plugin before 4.3.5 does not sanitize uploaded SVG files on every upload route, allowing users with the Author role and above to upload a file containing JavaScript, which will run in the browser of any user who opens it. Exploitation requires unfiltered file uploads to be enabled in the Elementor Website Builder WordPress plugin before 4.3.5 settings, which is not the default.

Metrics

CVSS 3.1 6.4/10CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-79

Affected software

No affected versions have been published.

Timeline

Published: Oct 21, 2026
Last modified: Oct 21, 2026
NVD status: Deferred

Related CVEs from 2026

CVE-2026-818136.8The Elementor Website Builder WordPress plugin before 4.3.5 does not sanitize the text content of SVG files, checking only their elements a CVE-2026-818145.1Affected versions of Flowintel render calendar event titles using innerHTML. Because those titles are derived from case titles, a user able CVE-2026-818177.2Affected versions of Flowintel contain an insecure direct object reference / broken object-level authorization issue across numerous task en CVE-2026-818188.6Affected versions of Flowintel contain an authorization flaw in the administrative user-edit API. The existing authorization check correct CVE-2026-818195.3Affected versions of Flowintel expose the /my_assignment/user API endpoint to any authenticated API user. The endpoint accepts a user_id par CVE-2026-81828.8IBM Langflow OSS 1.0.0 through 1.10.3 installations allow anyone on the internet to execute arbitrary code on the server without any credent CVE-2026-818205.1Affected versions of Flowintel construct timeline HTML using attacker-controllable MISP object fields such as: * object UUID; * CVE-2026-818218.4The vulnerability, if exploited, could allow a miscreant with read access to PIMBoards project files to decrypt and view sensitive informati CVE-2026-818228.4The vulnerability, if exploited, could allow a miscreant with read access to PIMBoards project files to reverse engineer PIMBoards users’ ap CVE-2026-818235.3The vulnerability, if exploited, could allow an unauthenticated miscreant to perform read operations intended only for PIMBoards users, resu CVE-2026-818244.7The vulnerability, if exploited, could allow a miscreant to run arbitrary JavaScript code in a browser session of a PIMBoards user who was s CVE-2026-818257.2The Simple Ajax Chat – Add a Fast, Secure Chat Box plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Chat Message in all