The Elementor Website Builder plugin fails to sanitize the text content of SVG files, inspecting only elements and attributes while leaving CDATA sections untouched. A user with Contributor or higher privileges can upload an SVG containing malicious JavaScript that is executed when the SVG is rendered inline on any page viewed by another user. This enables arbitrary client‑side code to run in the victim’s browser, potentially compromising session cookies, injecting further payloads, or redirecting the user.

All installations of Elementor version 4.3.4 and earlier are impacted. Any WordPress site that has not yet upgraded to 4.3.5 or newer can be targeted if a Contributor or higher privileged user uploads a crafted SVG. The flaw does not affect users lacking upload or contributor rights, and it does not affect installations that already use 4.3.5 or later.

The CVSS score of 6.8 denotes a moderate severity stored XSS, while an EPSS score of less than 1% indicates a very low probability of exploitation. The vulnerability is not listed in the CISA KEV catalog. Exploitation requires the attacker to first obtain Contributor or higher role on the target site, upload the malicious SVG, and then have another visitor render the page containing the file. The flaw is specific to Chromium‑based browsers; it does not affect Firefox. If leveraged, the attacker can execute arbitrary client‑side code in the context of the victim’s session.