MEDIUMCVSS v3.1 6.4Vulnerability
CVE-2026-81812
The Elementor Website Builder WordPress plugin before 4.3.5 does not sanitize uploaded SVG files on every upload route, allowing users with the Author role and above to upload a file containing JavaScript, which will run in the browser of any user who opens it. Exploitation requires unfiltered file uploads to be enabled in the Elementor Website Builder WordPress plugin before 4.3.5 settings, which is not the default.
Properties
- Severity
- MEDIUM
- Nvd fetched at
- 2026-10-22T22:14:18.200859+00:00
- Epss score
- 0.00213
- Cvss severity
- MEDIUM
- Cvss score
- 6.4
- Retrieved at
- 2026-10-22T22:17:35+00:00
- Last source
- FIRST EPSS
- Score
- 6.4
- Cvss version
- 3.1
- Cve id
- CVE-2026-81812
- Cvss vector
- CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:H
- First seen by Signal
- 2026-10-21T22:34:38+00:00
- Vector
- CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:H
- Published at
- 2026-10-21T06:16:49.730
- Last modified
- 2026-10-21T18:37:38.700
- Epss percentile
- 0.11074
Related Entities (1)
HAS_WEAKNESS (1)
Explore deeper with Ninja Signal's threat intelligence graph