CVE-2020-36171

The Elementor Website Builder plugin before version 3.0.14 allows authenticated users with the ability to edit posts to upload SVG files without adequate validation, potentially enabling the injection of malicious scripts or other harmful content within those files. The vulnerability stems from insufficient controls over SVG file uploads, which could be exploited by attackers with editor-level access to compromise site functionality.

Based on public CVE data (MITRE/NVD).