What is CVE-2026-81813?

CVE-2026-81813 is a medium-severity vulnerability in Elementor Website Builder, classified under Cross-site Scripting. CVSS score: 6.8/10. Published 2026-10-21.

How severe is CVE-2026-81813?

Medium severity. CVSS v3 base score is 6.8 out of 10.

XSS in Elementor Website Builder

CVE-2026-81813

The Elementor Website Builder WordPress plugin before 4.3.5 does not sanitize the text content of SVG files, checking only their elements and attributes, allowing users with the Contributor role and above to store a payload which breaks out when the SVG is rendered inline in a page and executes in the browser of any user viewing it. Execution is specific to Chromium-based browsers; Firefox is not affected.

Vulnerability class: XSS (Cross-Site Scripting)

Published 2026-10-21 · last modified 2026-10-21.

CVSS v3 metric

CVSS v3 base score 6.8 (Medium). Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H.

EPSS exploit prediction

No EPSS score from FIRST.org yet. New CVEs usually get one within a few days; no score means no signal yet, not low risk. How EPSS works.

Affected products

Elementor Website Builder

Weakness classification (CWE)

CWE-79 — Cross-site Scripting

References

wpscan.com/vulnerability/d7c6f47b-feda-4fba-99a3-af3a7c9c8417/ (technical-description, exploit, vdb-entry)

Frequently asked questions

What is CVE-2026-81813?: CVE-2026-81813 is a medium-severity vulnerability in Elementor Website Builder, classified under Cross-site Scripting. CVSS score: 6.8/10. Published 2026-10-21.
How severe is CVE-2026-81813?: Medium severity. CVSS v3 base score is 6.8 out of 10.