Elementor < 4.3.5 – Contributor+ Stored XSS via SVG CDATA Sanitizer Bypass

Elementor’s SVG sanitizer inspects only the elements and attributes of uploaded SVG files and ignores their text content. A user with the Contributor role or higher can upload an SVG whose CDATA content escapes the sanitizer and executes JavaScript when the SVG is rendered inline on a page. Execution was confirmed in Chromium-based browsers; Firefox is not affected.

Arbitrary JavaScript runs in the browser of any visitor or administrator viewing the affected page, which can lead to session hijacking, actions performed on behalf of administrators, and full site takeover.