{
 "id": "WPSEC-2026-0901",
 "url": "https://wpsec.com/vuln/WPSEC-2026-0901/",
 "json_url": "https://wpsec.com/vuln/WPSEC-2026-0901/advisory.json",
 "markdown_url": "https://wpsec.com/vuln/WPSEC-2026-0901/index.md",
 "title": "Elementor Website Builder <= 4.3.4 - Authenticated (Author+) Stored Cross-Site Scripting via File Upload Validation Bypass",
 "description": "The Elementor Website Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via file uploads in all versions up to, and including, 4.3.4 due to Elementor's upload file-type validation and sanitization only being applied to uploads flagged as 'elementor-wp-media-upload' and not to other Elementor uploads or sideloaded files. This makes it possible for authenticated attackers, with author-level access and above, to upload files such as unsanitized SVGs containing malicious scripts that execute when the file is accessed. Exploitation likely requires that Elementor's unfiltered file uploads support be enabled.",
 "plugin": {
  "slug": "elementor",
  "name": "Elementor Website Builder",
  "full_name": "Elementor Website Builder – more than just a page builder",
  "wordpress_org": "https://wordpress.org/plugins/elementor/",
  "advisories_url": "https://wpsec.com/vuln/plugin/elementor/",
  "attacksurface": "https://attacksurface.wpsec.com/plugin/elementor"
 },
 "type": "XSS",
 "cwe": [
  "CWE-79"
 ],
 "cve": [],
 "cvss": {
  "version": "3.1",
  "score": 4.9,
  "vector": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:L/A:N",
  "severity": "Medium"
 },
 "affected": {
  "ranges": [
   {
    "from": null,
    "from_inclusive": true,
    "to": "4.3.5",
    "to_inclusive": false
   }
  ],
  "text": [
   "all versions before 4.3.5"
  ]
 },
 "introduced_in": null,
 "fixed_in": "4.3.5",
 "remediation": "Update to 4.3.5 or later.",
 "fix_released": "2026-10-13T12:48:33+00:00",
 "published": "2026-10-14T12:52:26+00:00",
 "updated": "2026-10-14T12:12:59.952544+00:00",
 "also_published_as": null,
 "references": [
  "https://wpsec.com/vuln/WPSEC-2026-0901/",
  "https://plugins.svn.wordpress.org/elementor/tags/4.3.5/",
  "https://wordpress.org/plugins/elementor/"
 ],
 "attacksurface_url": "https://attacksurface.wpsec.com/plugin/elementor",
 "source": "WPSec",
 "license": {
  "name": "CC BY 4.0",
  "url": "https://creativecommons.org/licenses/by/4.0/"
 },
 "usage": {
  "plugin": "High",
  "affected_versions": "High",
  "as_of": "2026-10-14"
 }
}