CVE-2026-13330

The CVSS 6.1 rating for this SVG upload vulnerability treats 'Author and above' access as a meaningful privilege barrier. It isn't. Elementor's visual page builder already gives Author-level users direct access to embed arbitrary HTML and JavaScript through standard widgets—the intended workflow. A threat actor with Author access doesn't need to weaponize an SVG upload; they can achieve equivalent impact through the legitimate interface in seconds, with no suspicious file artifact and no upload required. The actual concern is narrower but more subtle than the CVE description implies. The plugin adds SVG to allowed MIME types without sanitization, creating a file that persists in wp-content/uploads with a browser-executable MIME type (image/svg+xml). This matters in two scenarios the CVSS scoring underweights: first, the uploaded SVG being served directly from the uploads directory where it executes on direct view—bypassing Elementor's audit logging, content review workflows, and edit history that would catch malicious JavaScript embedded through the intended interface; second, the file being included in exported themes or templates that get distributed or imported into other WordPress instances, potentially reaching higher-privilege roles like Administrator. This is a stealth execution primitive. A malicious Author leaving JS through the visual editor creates a traceable edit history. Uploading a clean SVG that executes via direct URL access leaves no activity log entry, no content review flag, and no collaboration feature trail. The vulnerability enables execution that specifically evades the operational security controls that give Author-role trust its limited meaning. For defenders: audit your wp-content/uploads directory for .svg files uploaded prior to patching, as these persist regardless of whether the plugin is active or has been replaced. Include SVG files in your backup migration audits—these artifacts travel with exports and imports long after the CVE is nominally resolved. The EPSS score of 0.00181 likely reflects that capable threat actors have simpler methods within the same trust boundary, but the secondary infection pathways this creates are real and durable.

Reviewed through automated stages and approved by a human before publication.