What is GHSA-cwqx-v6j9-jf65?

GHSA-cwqx-v6j9-jf65 is a security advisory published by GitHub Security Advisories with Medium severity. The Elementor Website Builder WordPress plugin before 4.3.5 does not sanitize uploaded SVG files...

Which CVE IDs does GHSA-cwqx-v6j9-jf65 cover?

GHSA-cwqx-v6j9-jf65 covers the following CVE IDs: CVE-2026-81812. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-cwqx-v6j9-jf65?

GHSA-cwqx-v6j9-jf65 has a CVSS v3 base score of 6.4, published by GitHub Security Advisories.

GHSA-cwqx-v6j9-jf65MediumCVSS 6.4

The Elementor Website Builder WordPress plugin before 4.3.5 does not sanitize uploaded SVG files...

Vendor

GitHub Security Advisories

Published

October 21, 2026

Last Modified

October 21, 2026

🔗 CVE IDs covered (1)

CVE-2026-81812 →

📋 Description

The Elementor Website Builder WordPress plugin before 4.3.5 does not sanitize uploaded SVG files on every upload route, allowing users with the Author role and above to upload a file containing JavaScript, which will run in the browser of any user who opens it. Exploitation requires unfiltered file uploads to be enabled in the Elementor Website Builder WordPress plugin before 4.3.5 settings, which is not the default.

🔗 References (3)

https://nvd.nist.gov/vuln/detail/CVE-2026-81812
https://wpscan.com/vulnerability/ba550282-d354-4d39-95c6-c4820a91f270
https://github.com/advisories/GHSA-cwqx-v6j9-jf65