Published October 21, 2026. Based on public reports available on that date; details may change.
CVE-2026-81812 and CVE-2026-81813 affect Elementor Website Builder versions before 4.3.5 and concern the handling of SVG uploads and SVG text content. Update Elementor to 4.3.5 or later, then review who can upload SVG files and whether untrusted SVG content has been added to the site.
What happened
Both reported issues involve SVG sanitization. An SVG looks like an image, but it is a text-based format that can include markup and, if handled unsafely, active browser content. A file that is acceptable as a logo or illustration can therefore need different safeguards from a JPEG or PNG.
CVE-2026-81812 concerns upload routes that did not sanitize SVG files on every path. The public record says this can allow a user with the Author role or above to upload a file containing JavaScript when Elementor's unfiltered file-upload setting is enabled. The record says that setting is not enabled by default.
CVE-2026-81813 concerns SVG text content. The record says Elementor checked elements and attributes but did not sanitize text content, creating a way for a Contributor or higher to store a payload that can execute when an SVG is rendered inline in a page. The report notes this execution is specific to Chromium-based browsers, and does not affect Firefox.
The practical result is similar in both cases: a malicious SVG may cause script to run in the browser of someone who views it. That could be a visitor, an editor, or an administrator, depending on where and how the file is used. The cited records do not report exploitation in the wild.
Who is affected
Elementor Website Builder releases before 4.3.5 are affected by both CVEs. Version 4.3.5 is the stated fix. Check production, staging, and other WordPress copies independently, since a staging site is often where design tools and contributor accounts are tested.
In the WordPress dashboard, go to Plugins, locate Elementor, and check the version shown there. With WP-CLI, run wp plugin list --name=elementor. An installed version earlier than 4.3.5 needs an update.
Do not focus only on the administrator account. The records describe lower-privileged roles in the upload path: Author or above for CVE-2026-81812 and Contributor or above for CVE-2026-81813. Review who has those roles, including former contractors and accounts created for content work. The WordPress maintenance plan checklist is a useful place to build regular plugin and account reviews into your process.
How to check your site
First, confirm the installed Elementor version and update status. Then review where SVG files are allowed and how they are used. The goal is not to manually inspect every image on a large site. Focus on files from people or periods you cannot confidently identify.
- In Media, search or filter for SVG files if your media workflow exposes their type.
- Review recent uploads, especially files supplied by untrusted users, contributors, or temporary accounts.
- Check Elementor settings for any option that permits unfiltered file uploads, and confirm it is necessary for the site.
- Review pages and templates that render SVG assets inline rather than simply linking to a static image.
- Review Users for Author, Contributor, Editor, and Administrator accounts that should no longer have access.
If you manage the server with shell access, find wp-content/uploads -type f -iname '*.svg' will list SVG files in the standard uploads directory. The command identifies files to review, not malicious files by itself. Be careful not to open a questionable SVG in a normal browser before you have decided how to inspect it safely.
Unexpected scripts, unfamiliar media uploads, and unexplained user accounts should be treated as investigation leads, not proof of a compromise. If the site has signs of active malicious content, use the containment and preservation steps in what to do in the first hour after a WordPress hack.
What to do now
Update Elementor to 4.3.5 or later. Use Dashboard, Updates or run wp plugin update elementor from the WordPress directory if that is part of your normal maintenance process. Check the public-facing pages and the Elementor editor afterward, particularly templates that use SVG assets.
Restrict SVG uploads to trusted people who have a real need to use them. If the site does not need SVG uploads, leaving them disabled reduces the number of ways untrusted active content can enter the site. Keep Contributor and Author roles limited to known users, and remove accounts that are no longer needed.
For SVG files that came from an unknown source, replace them with verified originals where possible. Preserve a copy first if you are investigating a suspected incident. A safe replacement process should include checking whether that file is referenced in Elementor templates, pages, widgets, or other site content.
Updating a plugin is an important fix, but it does not automatically remove a malicious file already stored in wp-content/uploads or undo content changes. If you find evidence that an unsafe file was uploaded or viewed, review user access and the affected pages. Our WordPress hardening service can help tighten file-upload and account controls after the immediate update.
When to get help
Get help if you cannot determine who uploaded SVG files, find unfamiliar content or user accounts, or suspect scripts have run in an administrator's browser. For suspected malicious content, WordPress malware removal can provide a disciplined cleanup; for a broader review of upload and access controls, consider a security audit.