Multiple XSS vulnerabilities patched in WordPress plugins October 2026
Sucuri publishes October 2026 roundup of medium and high-risk flaws in Elementor, LiteSpeed Cache, and WooCommerce.
70
CVE-2026-81812
XSS in SVG upload in Elementor Website Builder before 4.3.5
- CVSS 3.1
- 6.4 medium
- EPSS
- —
- Published
- ·
- Modified
AI analysisSummaries by Vani AI
The Elementor Website Builder WordPress plugin before 4.3.5 does not sanitize uploaded SVG files. Authors and higher can upload malicious SVG with JavaScript if unfiltered file uploads are enabled. This executes in the browser of any user viewing the file. Affected are sites using the plugin before 4.3.5.
What to do: Upgrade Elementor Website Builder WordPress plugin to 4.3.5 or later.
| Product | Affected | Fixed in |
|---|---|---|
| Elementor Website Builder | before 4.3.5 | 4.3.5 |
Estimated exposure
No basis for an estimate.
Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.
Description · NVD
The Elementor Website Builder WordPress plugin before 4.3.5 does not sanitize uploaded SVG files on every upload route, allowing users with the Author role and above to upload a file containing JavaScript, which will run in the browser of any user who opens it. Exploitation requires unfiltered file uploads to be enabled in the Elementor Website Builder WordPress plugin before 4.3.5 settings, which is not the default.
- Ecosystems
- WordPress
- Weakness
- CWE-79
- Vector
- CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:H