CVE-2026-81813

MediumCVSS 6.8/10Last modified Oct 21, 2026

Description

The Elementor Website Builder WordPress plugin before 4.3.5 does not sanitize the text content of SVG files, checking only their elements and attributes, allowing users with the Contributor role and above to store a payload which breaks out when the SVG is rendered inline in a page and executes in the browser of any user viewing it. Execution is specific to Chromium-based browsers; Firefox is not affected.

Metrics

CVSS 3.1 6.8/10CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-79

Affected software

No affected versions have been published.

Timeline

Published: Oct 21, 2026
Last modified: Oct 21, 2026
NVD status: Deferred

Related CVEs from 2026

CVE-2026-818145.1Affected versions of Flowintel render calendar event titles using innerHTML. Because those titles are derived from case titles, a user able CVE-2026-818177.2Affected versions of Flowintel contain an insecure direct object reference / broken object-level authorization issue across numerous task en CVE-2026-818188.6Affected versions of Flowintel contain an authorization flaw in the administrative user-edit API. The existing authorization check correct CVE-2026-818195.3Affected versions of Flowintel expose the /my_assignment/user API endpoint to any authenticated API user. The endpoint accepts a user_id par CVE-2026-81828.8IBM Langflow OSS 1.0.0 through 1.10.3 installations allow anyone on the internet to execute arbitrary code on the server without any credent CVE-2026-818205.1Affected versions of Flowintel construct timeline HTML using attacker-controllable MISP object fields such as: * object UUID; * CVE-2026-818218.4The vulnerability, if exploited, could allow a miscreant with read access to PIMBoards project files to decrypt and view sensitive informati CVE-2026-818228.4The vulnerability, if exploited, could allow a miscreant with read access to PIMBoards project files to reverse engineer PIMBoards users’ ap CVE-2026-818235.3The vulnerability, if exploited, could allow an unauthenticated miscreant to perform read operations intended only for PIMBoards users, resu CVE-2026-818244.7The vulnerability, if exploited, could allow a miscreant to run arbitrary JavaScript code in a browser session of a PIMBoards user who was s CVE-2026-818257.2The Simple Ajax Chat – Add a Fast, Secure Chat Box plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Chat Message in all CVE-2026-818269.1Affected versions of Flowintel do not revoke existing authenticated sessions when a user’s password is changed. This means that if an atta