Elementor Website Builder <= 4.3.4 - Authenticated (Author+) Stored Cross-Site Scripting via File Upload Validation Bypass
- ID
- WPSEC-2026-0901
- Plugin
- Elementor Website Builder – more than just a page builder (elementor)
- Affected
- all versions before 4.3.5
- Remediation
- Update to 4.3.5 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:L/A:N
- Weakness
- CWE-79
- Usage
- Plugin High · Affected versions High among sites WPSec scans, 2026-10-14
- Attack surface
- Elementor Website Builder on WPSec AttackSurface
- Fix released
- Published
Description
The Elementor Website Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via file uploads in all versions up to, and including, 4.3.4 due to Elementor's upload file-type validation and sanitization only being applied to uploads flagged as 'elementor-wp-media-upload' and not to other Elementor uploads or sideloaded files. This makes it possible for authenticated attackers, with author-level access and above, to upload files such as unsanitized SVGs containing malicious scripts that execute when the file is accessed. Exploitation likely requires that Elementor's unfiltered file uploads support be enabled.
References
- https://wpsec.com/vuln/WPSEC-2026-0901/
- https://plugins.svn.wordpress.org/elementor/tags/4.3.5/
- https://wordpress.org/plugins/elementor/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS