EUVD-2026-107083
GHSA-grh6-fqc7-f8f5
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAuthenticate as WordPress Contributor
-
ExploitUpload SVG with crafted text-node payload
-
ExecutionVictim opens page inline-rendering SVG in Chromium
-
ImpactExecute arbitrary JavaScript in victim's browser session
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization Output encoding, context-aware escaping
MITRE ATT&CK
2 techniques across 2 tactics: Initial Access, Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Requires an authenticated WordPress account with the Contributor role or higher on an Elementor site running a version before 4.3.5, and the ability to store an SVG file whose text content carries the payload (Elementor sanitizes only SVG elements/attributes, not text nodes). Exploitation further requires that the SVG be rendered inline in a page and that a victim actively view that page (UI:R). Key limiting factors: execution occurs ONLY in Chromium-based browsers - Firefox viewers are unaffected - and the attacker needs a valid contributor-level login rather than anonymous access. |
| Impact | This is a medium-severity stored XSS (CVSS 6.8, CWE-79) with publicly available exploit code (WPScan) but NO CISA KEV listing and NO EPSS score provided in the input, so there is no evidence of active or widespread exploitation - exploitation status is 'publicly available exploit code exists', not confirmed in-the-wild. The supplied CVSS vector (AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H) is internally questionable on two points: (1) PR:H is likely overstated - the description explicitly says exploitation is available to the Contributor role 'and above', and Contributor is a LOW-privilege authenticated role in WordPress, so PR:L is more defensible; and (2) C:H/I:H/A:H is aggressive for reflected/stored XSS, which typically yields limited, session-scoped impact (C:L/I:L/A:N). UI:R is correct and materially limits risk: a victim must actively view the page. Crucially, the description states execution is specific to Chromium-based browsers and Firefox is NOT affected, which narrows the exploitable victim population. Net: a real but conditional issue - authenticated-contributor + victim-interaction + Chromium-only - elevated in practical exposure mainly because Elementor is deployed on an enormous number of WordPress sites. Treat as a prompt-patch item, not an emergency. |
| Exploit ScenarioDerived | A user with Contributor (or higher) access uploads an SVG whose text content carries a script payload that survives Elementor's element/attribute-only sanitization. When a site administrator or visitor opens the page in a Chromium-based browser and the SVG is rendered inline, the payload executes in that viewer's browser session. A public proof-of-concept exists via WPScan, and the attack requires victim interaction (UI:R) and a Chromium browser. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 21, 2026
Stored cross-site scripting in Elementor Website Builder for WordPress before 4.3.5 lets an authenticated user with the Contributor role or higher upload an SVG whose text content carries a script payload that the plugin's sanitizer never inspects, since only SVG elements and attributes are validated. The payload fires when the SVG is rendered inline on a page and a victim views that page in a Chromium-based browser; Firefox users are unaffected, and exploitation requires the victim to actively load the poisoned page. Publicly available exploit code exists (published through WPScan) and the issue carries a vendor patch, but there is no CISA KEV listing and no evidence of active, widespread exploitation, making this a medium-severity (CVSS 6.8, CWE-79) stored XSS with meaningful but constrained prerequisites.
RemediationAI
Vendor-released patch: upgrade Elementor Website Builder to 4.3.5 or later - this is the only complete fix, since the defect is in the plugin's own SVG sanitizer and cannot be corrected by configuration. Confirm the running version under the WordPress Plugins screen or via WP-CLI (wp plugin list) after updating, and verify the reference advisory at https://wpscan.com/vulnerability/d7c6f47b-feda-4fba-99a3-af3a7c9c8417/ for the vendor's own guidance. Where an immediate update is not possible, the most effective compensating control is to stop accepting SVG uploads from lower-trust roles: disable SVG upload support entirely for the site, or restrict the capability to administrators only, so Contributor and Author accounts cannot seed the payload - the trade-off is that legitimate SVG assets must then be delivered as raster images or pre-sanitized files approved by an administrator. A content security policy that disallows inline script and restricts script-src to known origins will block execution even if a malicious SVG is rendered, at the cost of potentially breaking legitimate inline scripts in themes and other plugins. Because the payload only executes in Chromium-based browsers, advising the editorial team to review pages in Firefox is a weak, non-enforcing mitigation and should not be relied on as the primary control. Review existing media library entries and any Contributor-submitted SVG files for injected text-node script content as part of the cleanup, since patching does not remove payloads already stored.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The flaw is CWE-79 (improper neutralization of input during web page generation) manifesting in a file-upload sanitization path rather than a classic HTML form field. Elementor accepts SVG uploads and runs a sanitizer over the document that enumerates SVG elements and attributes, but it does not sanitize text-node content inside the SVG. Because SVG is XML and is frequently emitted inline into the page DOM rather than loaded through an isolated <img> context, script-bearing text content that survives the filter is parsed in the origin of the hosting site and executes there. The browser-specific nature of the bug (Chromium executes, Firefox does not) is consistent with differing inline-SVG scripting behavior between engines, which means the effective attack surface is a subset of visitors. The CVSS vector in the input data is AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H, while our independent assessment lowers the privileges required and treats the scope as changed (PR:L, S:C, C:L/I:L/A:N), reflecting that a Contributor-level account - the lowest role that can submit content - is sufficient, and that the impact is bounded by browser and victim-interaction constraints rather than granting server-side compromise.
Know when Elementor Website Builder gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H
Contributor is a low-privilege role so PR:L; stored payload executes in any viewer's browser crossing into their authority, so S:C; typical XSS yields limited C/I and no availability impact.
Primary rating from Vendor (WPScan).
CVSS VectorVendor: WPScan
Lifecycle Timeline
4DescriptionCVE.org
The Elementor Website Builder WordPress plugin before 4.3.5 does not sanitize the text content of SVG files, checking only their elements and attributes, allowing users with the Contributor role and above to store a payload which breaks out when the SVG is rendered inline in a page and executes in the browser of any user viewing it. Execution is specific to Chromium-based browsers; Firefox is not affected.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Cross-Site Scripting occurs when an application accepts untrusted data and sends it to a web browser without proper validation or encoding.
More in Elementor Website Builder
View allStored cross-site scripting in the Elementor Website Builder WordPress plugin before 4.3.5 allows users holding the Auth
Information disclosure in Elementor Website Builder (all versions before 4.1.4) allows authenticated WordPress users wit
Cross-site request forgery in Elementor Website Builder (all versions through 4.3.1) lets a remote attacker who holds no
Sensitive data exposure in Elementor Website Builder for WordPress (versions <= 4.1.3) allows contributor-level authenti
A DOM-based Cross-Site Scripting (XSS) vulnerability exists in Elementor Website Builder through version 3.35.5, allowin
Broken access control in Elementor Website Builder through version 3.35.5 permits high-privileged, network-based WordPre
Exploit-DB