Two Stored XSS Vulnerabilities Found in Elementor Website Builder (CVE-2026-81812, CVE-2026-81813)

What Happened

Two separate CVEs were published for the Elementor Website Builder plugin on the same day. CVE-2026-81812 describes a failure to sanitize uploaded SVG files on every upload route, which allows users with the Author role or above to upload a file containing JavaScript that executes in the browser of anyone who opens it. CVE-2026-81813 describes a related but distinct issue: Elementor checks the elements and attributes of SVG files but does not sanitize their text content, allowing users with the Contributor role or above to store a payload that breaks out and executes when the SVG is rendered inline on a page.

Technical Cause

Both vulnerabilities are classified as CWE-79 (Cross-Site Scripting) and originate from incomplete SVG file sanitization in Elementor Website Builder before version 4.3.5. CVE-2026-81812 results from the plugin not sanitizing uploaded SVG files consistently across every upload route. CVE-2026-81813 results from the plugin only validating SVG elements and attributes while leaving the text content unsanitized, allowing a crafted payload to break out of expected bounds when the SVG is rendered inline. Notably, exploitation of CVE-2026-81813 is specific to Chromium-based browsers; Firefox is reported as not affected.

Who Is Affected

Sites running the Elementor Website Builder WordPress plugin prior to version 4.3.5 are affected. For CVE-2026-81812, exploitation requires an authenticated user with the Author role or above, and additionally requires that the plugin's 'unfiltered file uploads' setting be enabled, which is not the default configuration. For CVE-2026-81813, exploitation requires an authenticated user with the Contributor role or above, and successful execution is limited to visitors using Chromium-based browsers.

Affected Versions

Both vulnerabilities affect Elementor Website Builder versions before 4.3.5. The fact package does not state whether version 4.3.5 itself contains the fix for these specific issues, only that it is referenced as the boundary version in the affected range data; site owners should confirm patch status with the vendor directly.

Fixes and Mitigation

The fact package indicates no confirmed fix is currently available for either vulnerability (fix_available is marked false for both CVEs), despite version 4.3.5 appearing as a boundary in the affected range data. This is an inconsistency in the available information, and we cannot confirm whether a patched release exists or is forthcoming. As a mitigation, site administrators can review and, where appropriate, disable the 'unfiltered file uploads' setting in Elementor, and restrict Author and Contributor role assignments to trusted users to reduce exposure.

Recommended Action

Site owners using Elementor Website Builder should check the plugin's current version and consult the vendor's official changelog for confirmation of a security fix, since this fact package does not confirm a resolved version. In the meantime, ensure the 'unfiltered file uploads' setting remains disabled (its default state) and limit Author/Contributor-level access to trusted personnel only, as both vulnerabilities depend on these elevated roles to be exploited.