Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
1 selected

2 records

Release: Elementor Website Builder 4.3.5 Clear all filters
TI-2026-78566 CVE-2026-81813 · GHSA-grh6-fqc7-f8f5

Stored XSS in Elementor Website Builder via SVG sanitizer bypass

Priority LOW 32

The Elementor Website Builder WordPress plugin before 4.3.5 does not sanitize the text content of SVG files, checking only their elements and attributes, allowing users with the Contributor role and above to store a payl…

CVSS 3.1MEDIUM 6.8 Network High privileges User interaction EPSS 0.00412 Published 2026-10-21 Fixed in 4.3.5 CWE-79
TI-2026-78565 CVE-2026-81812 · GHSA-cwqx-v6j9-jf65

Stored cross-site scripting in Elementor via SVG uploads

Priority LOW 30

The Elementor Website Builder WordPress plugin before 4.3.5 does not sanitize uploaded SVG files on every upload route, allowing users with the Author role and above to upload a file containing JavaScript, which will run…

CVSS 3.1MEDIUM 6.4 Network High privileges User interaction EPSS 0.00278 Published 2026-10-21 Fixed in 4.3.5 CWE-79