CVE-2026-81813
CVE-2026-81813 · Elementor < 4.3.5 - Contributor+ Stored XSS via SVG CDATA Sanitizer Bypass
Cette page présente des faits issus de sources publiques. Consultez l’avis original avant toute mise à jour.
The Elementor Website Builder WordPress plugin before 4.3.5 does not sanitize the text content of SVG files, checking only their elements and attributes, allowing users with the Contributor role and above to store a payload which breaks out when the SVG is rendered inline in a page and executes in the browser of any user viewing it. Execution is specific to Chromium-based browsers; Firefox is not affected.
CVSS 6.8 · Moyenne · EPSS 0,4% · Correctif disponible
- Publication
- Mise à jour
Produits et versions concernés
elementor website builder
- Versions du logiciel
- ≥ 0, < 4.3.5: Concernée (semver)
Mettez à jour vers 4.3.5