Cross-Site Scripting Vulnerability in Elementor Website Builder Plugin
CVE-2026-81813

Currently unrated

Key Information:

Vendor

WordPress
Status
Elementor Website Builder
Vendor
CVE Published:
21 October 2026

Badges

👾 Exploit Exists🟡 Public PoC

What is CVE-2026-81813?

The Elementor Website Builder plugin for WordPress prior to version 4.3.5 has a security flaw that allows users with the Contributor role and higher to embed malicious SVG files. These files are improperly sanitized, making it possible for the payload to execute when rendered inline within a page. This vulnerability specifically affects users of Chromium-based browsers, while users of Firefox remain unaffected. Website owners utilizing this plugin must update to the latest version to mitigate the risk of exploitation.

Affected Version(s)

Elementor Website Builder 0 < 4.3.5

Exploit Proof of Concept (PoC)

PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.

CVE-2026-81813 - Proof of Concept

References

https://wpscan.com/vulnerability/d7c6f47b-feda-4fba-99a3-...
exploitvdb-entrytechnical-description

Timeline

  • 🟡

    Public PoC available

  • 👾

    Exploit known to exist

  • Vulnerability published

  • Vulnerability Reserved

Credit

Mohammed Abd Alrahman
WPScan
.