# Elementor Website Builder <= 4.3.4 - Authenticated (Author+) Stored Cross-Site Scripting via File Upload Validation Bypass

- **ID:** WPSEC-2026-0901
- **Plugin:** Elementor Website Builder – more than just a page builder (`elementor`), https://wordpress.org/plugins/elementor/
- **Affected versions:** all versions before 4.3.5
- **Fixed in:** 4.3.5 (Update to 4.3.5 or later.)
- **Severity:** Medium 4.9 (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:L/A:N)
- **Weakness:** CWE-79
- **Usage among sites WPSec scans:** plugin High, affected versions High (as of 2026-10-14)
- **Attack surface analysis:** https://attacksurface.wpsec.com/plugin/elementor
- **Fix released:** 2026-10-13
- **Published:** 2026-10-14
- **URL:** https://wpsec.com/vuln/WPSEC-2026-0901/

## Description

The Elementor Website Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via file uploads in all versions up to, and including, 4.3.4 due to Elementor's upload file-type validation and sanitization only being applied to uploads flagged as 'elementor-wp-media-upload' and not to other Elementor uploads or sideloaded files. This makes it possible for authenticated attackers, with author-level access and above, to upload files such as unsanitized SVGs containing malicious scripts that execute when the file is accessed. Exploitation likely requires that Elementor's unfiltered file uploads support be enabled.

## References

- https://wpsec.com/vuln/WPSEC-2026-0901/
- https://plugins.svn.wordpress.org/elementor/tags/4.3.5/
- https://wordpress.org/plugins/elementor/

Source: WPSec, https://wpsec.com/vuln/WPSEC-2026-0901/

License: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). Free to use, share and adapt, also commercially, if you credit WPSec and link to this advisory.