Multiple XSS vulnerabilities patched in WordPress plugins October 2026
Sucuri publishes October 2026 roundup of medium and high-risk flaws in Elementor, LiteSpeed Cache, and WooCommerce.
70
CVE-2026-81813
Stored XSS in Elementor Website Builder WordPress plugin before 4.3.5
- CVSS 3.1
- 6.8 medium
- EPSS
- —
- Published
- ·
- Modified
AI analysisSummaries by Vani AI
Elementor Website Builder WordPress plugin before 4.3.5 does not sanitize SVG files, allowing stored payloads to execute in Chromium-based browsers when rendered inline. Contributors and higher roles can upload malicious SVGs to posts or pages. Affects WordPress sites using the vulnerable plugin, enabling code execution for any page viewer.
What to do: Upgrade to Elementor Website Builder 4.3.5. No workaround is listed.
| Product | Affected | Fixed in |
|---|---|---|
| Elementor Website Builder | before 4.3.5 | 4.3.5 |
Estimated exposure
largeNo basis for an estimate.
Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.
Description · NVD
The Elementor Website Builder WordPress plugin before 4.3.5 does not sanitize the text content of SVG files, checking only their elements and attributes, allowing users with the Contributor role and above to store a payload which breaks out when the SVG is rendered inline in a page and executes in the browser of any user viewing it. Execution is specific to Chromium-based browsers; Firefox is not affected.
- Ecosystems
- WordPress
- Weakness
- CWE-79
- Vector
- CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H