← back to popular plugins
wordfence / plugin · unlimited-elements-for-elementor
Unlimited Elements for Elementor
unlimited-elements-for-elementor
total installs
300,000
total vulns
31
critical
0
high
12
medium
19
low
0
latest vuln
—
patched
31
unpatched
0
avg time to patch
—
vulnerabilities
(31)
Unlimited Elements for Elementor <= 2.0.22 - Missing Authorization
medium
✓ patched
The Unlimited Elements for Elementor plugin for WordPress is vulnerable to unauthorized access in all versions up to, and including, 2.0.22. This is due to a missing capability check on a function. This makes it possible for authenticated attackers, with contributor-level access and above, to perform an unauthorized action.
Unlimited Elements for Elementor <= 2.0.20 - Unauthenticated SQL Injection
high
✓ patched
cve id
CVE-2026-103355 ↗
cvss score
7.5
cwe
CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
published
Oct 2, 2026
The Unlimited Elements for Elementor plugin for WordPress is vulnerable to SQL Injection in all versions up to, and including, 2.0.20. This is due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
Unlimited Elements for Elementor <= 2.0.19 - Authenticated (Contributor+) PHP Object Injection
high
✓ patched
cve id
CVE-2026-95534 ↗
cvss score
7.5
cwe
CWE-502: Deserialization of Untrusted Data
published
Oct 2, 2026
The Unlimited Elements for Elementor plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 2.0.19. This is due to deserialization of untrusted input. This makes it possible for authenticated attackers, with contributor-level access and above, to inject a PHP Object. No known POP chain is present in the vulnerable software. If a POP chain is present via an additional plugin or theme installed on the target system, it could allow the attacker to delete arbitrary files, retrieve sensitive data, or execute code.
Unlimited Elements for Elementor <= 2.0.20 - Reflected Cross-Site Scripting
medium
✓ patched
cve id
CVE-2026-103344 ↗
cvss score
6.1
cwe
CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
published
Oct 2, 2026
The Unlimited Elements for Elementor plugin for WordPress is vulnerable to Reflected Cross-Site Scripting in all versions up to, and including, 2.0.20. This is due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
Unlimited Elements for Elementor <= 2.0.19 - Unauthenticated Stored Cross-Site Scripting
high
✓ patched
cve id
CVE-2026-94662 ↗
cvss score
7.2
cwe
CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
published
Oct 2, 2026
The Unlimited Elements for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to, and including, 2.0.19. This is due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Unlimited Elements for Elementor <= 2.0.20 - Reflected Cross-Site Scripting
medium
✓ patched
cve id
CVE-2026-103342 ↗
cvss score
6.1
cwe
CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
published
Oct 1, 2026
The Unlimited Elements for Elementor plugin for WordPress is vulnerable to Reflected Cross-Site Scripting in all versions up to, and including, 2.0.20. This is due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
Unlimited Elements for Elementor <= 2.0.20 - Missing Authorization
medium
✓ patched
The Unlimited Elements for Elementor plugin for WordPress is vulnerable to unauthorized access in all versions up to, and including, 2.0.20. This is due to a missing capability check on a function. This makes it possible for unauthenticated attackers to perform an unauthorized action.
Unlimited Elements for Elementor <= 2.0.20 - Authenticated (Contributor+) SQL Injection
medium
✓ patched
cve id
CVE-2026-103338 ↗
cvss score
6.5
cwe
CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
published
Oct 1, 2026
The Unlimited Elements for Elementor plugin for WordPress is vulnerable to SQL Injection in all versions up to, and including, 2.0.20. This is due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with contributor-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
Unlimited Elements For Elementor 1.5.139 - 2.0.20 - Unauthenticated SQL Injection
high
✓ patched
cve id
CVE-2026-85568 ↗
cvss score
7.5
cwe
CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
published
Oct 1, 2026
The Unlimited Elements For Elementor plugin for WordPress is vulnerable to SQL Injection in versions 1.5.139 through 2.0.20. This is due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
Unlimited Elements For Elementor 1.5.142 - 2.0.20 - Authenticated (Subscriber+) SQL Injection
medium
✓ patched
cve id
CVE-2026-92923 ↗
cvss score
6.5
cwe
CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
published
Oct 1, 2026
The Unlimited Elements For Elementor plugin for WordPress is vulnerable to SQL Injection in versions 1.5.142 through 2.0.20. This is due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with subscriber-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
Unlimited Elements For Elementor <= 2.0.20 - Authenticated (Admin+) Arbitrary File Write
high
✓ patched
cve id
CVE-2026-85015 ↗
cvss score
7.2
cwe
CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
published
Oct 1, 2026
The Unlimited Elements For Elementor plugin for WordPress is vulnerable to Path Traversal to Arbitrary File Write in all versions up to, and including, 2.0.20. This is due to insufficient validation on zip files. This makes it possible for authenticated attackers to write to files outside of their intended directory.
Unlimited Elements For Elementor <= 2.0.20 - Authenticated (Contributor+) Stored Cross-Site Scripting
medium
✓ patched
cve id
CVE-2026-85016 ↗
cvss score
6.4
cwe
CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
published
Sep 30, 2026
The Unlimited Elements For Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to, and including, 2.0.20. This is due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Unlimited Elements For Elementor <= 2.0.20 - Authenticated (Subscriber+) Arbitrary Shortcode Execution
medium
✓ patched
cve id
CVE-2026-92924 ↗
cvss score
5.4
cwe
CWE-94: Improper Control of Generation of Code ('Code Injection')
published
Sep 30, 2026
The Unlimited Elements For Elementor plugin for WordPress is vulnerable to Arbitrary Shortcode Execution in all versions up to, and including, 2.0.20. This is due to the use of do_shortcode() on user supplied input. This makes it possible for authenticated attackers, with subscriber-level access and above, to execute arbitrary shortcodes registered on the site. The impact depends on which shortcodes the site has registered, so a site running a plugin whose shortcodes expose data or perform actions is affected more severely.
Unlimited Elements For Elementor <= 2.0.19 - Authenticated (Subscriber+) PHP Object Injection
high
✓ patched
cve id
CVE-2026-85017 ↗
cvss score
7.5
cwe
CWE-502: Deserialization of Untrusted Data
published
Sep 18, 2026
The Unlimited Elements For Elementor plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 2.0.19. This is due to deserialization of untrusted input. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject a PHP Object. No known POP chain is present in the vulnerable software. If a POP chain is present via an additional plugin or theme installed on the target system, it could allow the attacker to delete arbitrary files, retrieve sensitive data, or execute code.
Unlimited Elements For Elementor <= 2.0.19 - Authenticated (Contributor+) Server-Side Request Forgery
medium
✓ patched
cve id
CVE-2026-66608 ↗
cvss score
6.4
cwe
CWE-918: Server-Side Request Forgery (SSRF)
published
Sep 17, 2026
The Unlimited Elements For Elementor plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 2.0.19. This makes it possible for authenticated attackers, with contributor-level access and above, to make web requests to arbitrary locations originating from the web application which can be used to query and modify information from internal services.
Unlimited Elements For Elementor <= 2.0.16 - Reflected Cross-Site Scripting
medium
✓ patched
cve id
CVE-2026-77150 ↗
cvss score
6.1
cwe
CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
published
Sep 10, 2026
The Unlimited Elements For Elementor plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via 'data[name]' Parameter in all versions up to, and including, 2.0.16 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link. The show_preview AJAX action is registered for unauthenticated users and is gated only by a nonce, which an unauthenticated attacker can retrieve by loading any publicly accessible page that emits it.
Unlimited Elements For Elementor <= 2.0.16 - Unauthenticated SQL Injection
high
✓ patched
cve id
CVE-2026-18561 ↗
cvss score
7.5
cwe
CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
published
Sep 10, 2026
The Unlimited Elements For Elementor plugin for WordPress is vulnerable to SQL Injection via the 'addontype' parameter in versions up to, and including, 2.0.16. This is due to insufficient escaping on the user-supplied parameter and the lack of sufficient preparation on the existing SQL query in the getWhereString() function; when the parameter is supplied as an array, element zero is used verbatim as the SQL comparison operator and concatenated into the WHERE clause without sanitization, while normalizeAjaxInputData() strips WordPress's magic_quotes protection from the value. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
Unlimited Elements For Elementor <= 2.0.17 - Unauthenticated Stored Cross-Site Scripting
high
✓ patched
cve id
CVE-2026-84820 ↗
cvss score
7.2
cwe
CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
published
Sep 7, 2026
The Unlimited Elements For Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to, and including, 2.0.17. This is due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Unlimited Elements For Elementor <= 2.0.17 - Reflected Cross-Site Scripting via 'formData[id]' Parameter
medium
✓ patched
cve id
CVE-2026-75586 ↗
cvss score
6.1
cwe
CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
published
Sep 4, 2026
The Unlimited Elements For Elementor plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via 'formData[id]' Parameter in all versions up to, and including, 2.0.17 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link. The front-end AJAX handler is registered on the public 'wp' action with no nonce, capability, or referer check, and the raw attacker-controlled id value is interpolated verbatim into an exception message that is echoed back without escaping; when the response is served as text/html rather than application/json, the browser parses the injected markup.
Unlimited Elements For Elementor <= 2.0.17 - Missing Authorization
medium
✓ patched
The Unlimited Elements For Elementor plugin for WordPress is vulnerable to unauthorized access in all versions up to, and including, 2.0.17. This is due to a missing capability check on a function. This makes it possible for unauthenticated attackers to perform an unauthorized action.
Unlimited Elements For Elementor <= 2.0.14 - Authenticated (Contributor+) Arbitrary File Download
medium
✓ patched
cve id
CVE-2026-28146 ↗
cvss score
6.5
cwe
CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
published
Aug 3, 2026
The Unlimited Elements For Elementor plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 2.0.14. This makes it possible for authenticated attackers, with Contributor-level access and above, to read the contents of arbitrary files on the server, which can contain sensitive information.
Unlimited Elements For Elementor <= 2.0.15 - Missing Authorization
medium
✓ patched
The Unlimited Elements For Elementor plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on a function in versions up to, and including, 2.0.15. This makes it possible for authenticated attackers, with contributor-level access and above, to perform an unauthorized action.
Unlimited Elements For Elementor <= 2.0.12 - Unauthenticated Stored Cross-Site Scripting
high
✓ patched
cve id
CVE-2026-57718 ↗
cvss score
7.2
cwe
CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
published
Jul 9, 2026
The Unlimited Elements For Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 2.0.12 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Unlimited Elements for Elementor <= 2.0.10 - Unauthenticated Stored Cross-Site Scripting
high
✓ patched
cve id
CVE-2026-10081 ↗
cvss score
7.2
cwe
CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
published
Jun 29, 2026
The Unlimited Elements for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 2.0.10 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Unlimited Elements For Elementor <= 2.0.8 - Authenticated (Contributor+) SQL Injection
medium
✓ patched
cve id
CVE-2026-48837 ↗
cvss score
6.5
cwe
CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
published
May 26, 2026
The Unlimited Elements For Elementor plugin for WordPress is vulnerable to SQL Injection in versions up to, and including, 2.0.8 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with contributor-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
Unlimited Elements For Elementor <= 2.0.7 - Authenticated (Contributor+) SQL Injection via 'filter_search' Parameter
medium
✓ patched
cve id
CVE-2026-5486 ↗
cvss score
6.5
cwe
CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
published
May 13, 2026
The Unlimited Elements for Elementor plugin for WordPress is vulnerable to SQL Injection via the 'data[filter_search]' parameter in the get_cat_addons AJAX action in versions up to and including 2.0.7. This is due to insufficient input sanitization and the use of deprecated escaping functions combined with direct string concatenation in SQL query construction. The vulnerability is exacerbated because the normalizeAjaxInputData() function calls stripslashes() on all user input, removing the protection provided by WordPress's wp_magic_quotes() function. Subsequently, the filter_search parameter is escaped using the deprecated wpdb->_escape() function and then directly concatenated into a LIKE clause without using prepared statements. This makes it possible for authenticated attackers, with Contributor-level access and above (who can obtain a valid nonce through the Elementor editor), to inject arbitrary SQL commands and extract sensitive information from the database.
Unlimited Elements For Elementor <= 2.0.6 - Authenticated (Contributor+) Arbitrary File Read via Path Traversal in Repeater JSON/CSV URL with Path Traversal
high
✓ patched
cve id
CVE-2026-4659 ↗
cvss score
7.5
cwe
CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
published
Apr 16, 2026
The Unlimited Elements for Elementor plugin for WordPress is vulnerable to Arbitrary File Read via the Repeater JSON/CSV URL parameter in versions up to, and including, 2.0.6. This is due to insufficient path traversal sanitization in the URLtoRelative() and urlToPath() functions, combined with the ability to enable debug output in widget settings. The URLtoRelative() function only performs a simple string replacement to remove the site's base URL without sanitizing path traversal sequences (../), and the cleanPath() function only normalizes directory separators without removing traversal components. This allows an attacker to provide a URL like http://site.com/../../../../etc/passwd which, after URLtoRelative() strips the domain, results in /../../../../etc/passwd being concatenated with the base path and ultimately resolved to /etc/passwd. This makes it possible for authenticated attackers with Author-level access and above to read arbitrary local files from the WordPress host, including sensitive files such as wp-config.
Unlimited Elements For Elementor <= 2.0.5 - Unauthenticated Stored Cross-Site Scripting via Form Entry Fields
high
✓ patched
cve id
CVE-2026-2724 ↗
cvss score
7.2
cwe
CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
published
Mar 9, 2026
The Unlimited Elements for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the form entry fields in all versions up to, and including, 2.0.5. This is due to insufficient input sanitization and output escaping on form submission data displayed in the admin Form Entries Trash view. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever an administrator views the trashed form entries.
Unlimited Elements for Elementor <= 2.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Border Hero Widget
medium
✓ patched
cve id
CVE-2025-14274 ↗
cvss score
5.4
cwe
CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
published
Feb 2, 2026
The Unlimited Elements for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Border Hero widget's Button Link field in versions up to 2.0.1. This is due to insufficient input sanitization and output escaping on user-supplied URLs. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Unlimited Elements For Elementor <= 1.5.148 - Authenticated (Contributor+) Stored Cross-Site Scripting
medium
✓ patched
cve id
CVE-2025-8603 ↗
cvss score
6.4
cwe
CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
published
Aug 27, 2025
The Unlimited Elements For Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via several widgets in all versions up to, and including, 1.5.148 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Unlimited Elements For Elementor <= 1.5.142 - Authenticated (Contributor+) Stored Cross-Site Scripting
medium
✓ patched
cve id
CVE-2025-1663 ↗
cvss score
6.4
cwe
CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
published
Apr 2, 2025
The Unlimited Elements For Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via several widgets in all versions up to, and including, 1.5.142 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.