elementor_website_builder vulnerabilities
CVEs whose affected-version data names the elementor_website_builder package. Each record lists the affected and patched versions; check a specific version with the dependency checker or POST /api/sbom.
2 CVEsRSS
CVE-2026-81813NoneElementor < 4.3.5 - Contributor+ Stored XSS via SVG CDATA Sanitizer Bypass
The Elementor Website Builder WordPress plugin before 4.3.5 does not sanitize the text content of SVG files, checking only their elements and attributes, allowing users with the Contributor role and above to store a payload which breaks…
▾ Sunlitvia CVEORG
CVE-2026-81812NoneElementor < 4.3.5 - Author+ Stored XSS via SVG Upload
The Elementor Website Builder WordPress plugin before 4.3.5 does not sanitize uploaded SVG files on every upload route, allowing users with the Author role and above to upload a file containing JavaScript, which will run in the browser …
▾ Sunlitvia CVEORG