Elementor Website Builder EUVD-2026-107082

Exploitation requires two specific preconditions: (1) the 'unfiltered file uploads' option within the Elementor Website Builder plugin settings must be explicitly enabled, which the description states is NOT the default; and (2) the attacker must already hold an Author role or higher on the WordPress site, giving upload access. The payload is stored, so it additionally depends on a second user (UI:R) opening or previewing the malicious SVG for the JavaScript to execute. These three factors - non-default configuration, authenticated mid-tier access, and required victim interaction - substantially limit real-world exploitability despite the network attack vector.

This is a moderate, conditional-risk issue rather than an urgent priority. The supplied CVSS 3.1 vector (AV:N/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:H, 6.4) combines network reach with several strong dampeners: high attack complexity, high privileges, and required user interaction. The C:H/I:H/A:H impact rating appears inflated for a stored XSS (CWE-79) whose effect is JavaScript executing in a victim's browser - typical XSS impact is low/limited, so treat the 'High' triad with skepticism. Publicly available exploit code exists (WPScan), which raises practical concern, but there is no EPSS score provided and no CISA KEV listing, so there is no evidence of active exploitation - do not conflate POC availability with in-the-wild use. The single most important risk limiter is that exploitation requires the non-default 'unfiltered file uploads' setting to be enabled AND an attacker possessing Author-role-or-above access. Note a tension between signals: the CVSS vector marks PR:H, yet the description says 'Author role and above' (a mid-tier WordPress role), so the real privilege bar is likely lower than PR:H implies - verify role mapping with the vendor advisory. Net: a real but gated, lower-urgency vulnerability for most deployments, elevated only where the unsafe upload setting has been turned on.

An attacker who already holds an Author (or higher) account on a WordPress site where the Elementor administrator has enabled unfiltered file uploads uploads a crafted SVG containing embedded JavaScript. When any other user - such as an administrator reviewing media - opens or previews that SVG, the script executes in their authenticated browser session, enabling session/cookie theft or admin-context actions. Public exploit code for this technique is available via WPScan.