WordPress Plugin Vulnerabilities

Elementor < 2.9.8 - SVG Sanitizer Bypass leading to Authenticated Stored XSS

Description

Jerome Bruandet, from NinTechNet, discovered a bypass in the SVG sanitizer, which could lead to an authenticated stored XSS issue from users with the upload_files capability.

Affects Plugins

Plugin icon
elementor
Fixed in 2.9.8

References

CVE
CVE-2020-36703
URL
https://blog.nintechnet.com/wordpress-elementor-plugin-fixed-svg-xss-protection-bypass-vulnerability/

Miscellaneous

Original Researcher
Jerome Bruandet (NinTechNet)
Verified
No
WPVDB ID
e601fc58-97a0-4a67-8955-abf0e37e74ae

Timeline

Publicly Published
2020-05-06 (about 5 years ago)
Added
2020-05-06 (about 5 years ago)
Last Updated
2023-06-08 (about 2 years ago)

Other

Published
Title
Published
2015-11-11
Title
BuddyPress <= 2.3.4 - Authenticated Privilege Escalation
Published
2014-08-01
Title
Captcha 2.12-3.8.1 - Captcha Bypass
Published
2025-11-03
Title
WP 2FA < 3.0.0 - Second Factor Bypass
Published
2019-03-26
Title
Nested Pages <= 3.0.7 - Post Edit Bypass
Published
2016-03-22
Title
Memphis Document Library Plugin <= 3.1.5 - Arbitrary File Download