Live Vulnerability Intelligence
Threat Database
Search CVEs, inspect descriptions, and open detail pages with AI-assisted technical context.
Threat Entry
Updated 2026-11-07
Unlimited Elements For Elementor - Security Vulnerability (CVE-2026-121579)
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Unlimited Elements Unlimited Elements For Elementor (Free Widgets, Addons, Templates) unlimited-elements-for-elementor allows Stored XSS.This issue affects Unlimited Elements For Elementor (Free Widgets, Addons, Templates): from n/a through 2.0.26.
PLUGIN
Unlimited Elements For Elementor
CVE-2026-121579
Risk Score
Threat Entry
Updated 2026-11-07
Unlimited Elements For Elementor - Security Vulnerability (CVE-2026-116558)
The Unlimited Elements for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the '/ inside the attacker-controlled RSS feed body' parameter in all versions up to, and including, 2.0.26 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This is exploitable against any site whose administrator has placed the RSS Feed catalog widget pointing at a feed URL the attacker controls, as the plugin's…
PLUGIN
Unlimited Elements For Elementor
CVE-2026-116558
Risk Score
Threat Entry
Updated 2026-11-04
Unlimited Elements For Elementor - Security Vulnerability (CVE-2026-62007)
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Unlimited Elements Unlimited Elements For Elementor (Free Widgets, Addons, Templates) unlimited-elements-for-elementor allows Reflected XSS.This issue affects Unlimited Elements For Elementor (Free Widgets, Addons, Templates): from n/a through 2.0.26.
PLUGIN
Unlimited Elements For Elementor
CVE-2026-62007
Risk Score
Threat Entry
Updated 2026-10-30
Unlimited Elements For Elementor - Security Vulnerability (CVE-2026-62121)
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Unlimited Elements Unlimited Elements For Elementor (Free Widgets, Addons, Templates) unlimited-elements-for-elementor allows PHP Local File Inclusion.This issue affects Unlimited Elements For Elementor (Free Widgets, Addons, Templates): from n/a through 2.0.26.
PLUGIN
Unlimited Elements For Elementor
CVE-2026-62121
Risk Score
Threat Entry
Updated 2026-10-30
Unlimited Elements For Elementor - Security Vulnerability (CVE-2026-62023)
Missing Authorization vulnerability in Unlimited Elements Unlimited Elements For Elementor (Free Widgets, Addons, Templates) unlimited-elements-for-elementor allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Unlimited Elements For Elementor (Free Widgets, Addons, Templates): from n/a through 2.0.26.
PLUGIN
Unlimited Elements For Elementor
CVE-2026-62023
Risk Score
Threat Entry
Updated 2026-10-08
Unlimited Elements For Elementor - Security Vulnerability (CVE-2026-95534)
Deserialization of Untrusted Data vulnerability in Unlimited Elements Unlimited Elements For Elementor (Free Widgets, Addons, Templates) allows Object Injection. This issue affects Unlimited Elements For Elementor (Free Widgets, Addons, Templates): from n/a through 2.0.19.
PLUGIN
Unlimited Elements For Elementor
CVE-2026-95534
Risk Score
Threat Entry
Updated 2026-10-08
Unlimited Elements For Elementor - Security Vulnerability (CVE-2026-94662)
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Unlimited Elements Unlimited Elements For Elementor (Free Widgets, Addons, Templates) allows Stored XSS. This issue affects Unlimited Elements For Elementor (Free Widgets, Addons, Templates): from n/a through 2.0.19.
PLUGIN
Unlimited Elements For Elementor
CVE-2026-94662
Risk Score
Threat Entry
Updated 2026-10-06
Unlimited Elements For Elementor - Security Vulnerability (CVE-2026-105064)
Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection') vulnerability in Unlimited Elements Unlimited Elements For Elementor (Free Widgets, Addons, Templates) unlimited-elements-for-elementor allows Parameter Injection.This issue affects Unlimited Elements For Elementor (Free Widgets, Addons, Templates): from n/a through 2.0.22.
PLUGIN
Unlimited Elements For Elementor
CVE-2026-105064
Risk Score
Threat Entry
Updated 2026-10-06
Unlimited Elements For Elementor - Security Vulnerability (CVE-2026-103355)
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Unlimited Elements Unlimited Elements For Elementor (Free Widgets, Addons, Templates) unlimited-elements-for-elementor allows Blind SQL Injection.This issue affects Unlimited Elements For Elementor (Free Widgets, Addons, Templates): from n/a through 2.0.20.
PLUGIN
Unlimited Elements For Elementor
CVE-2026-103355
Risk Score
Threat Entry
Updated 2026-10-06
Unlimited Elements For Elementor - Security Vulnerability (CVE-2026-103344)
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Unlimited Elements Unlimited Elements For Elementor (Free Widgets, Addons, Templates) unlimited-elements-for-elementor allows Reflected XSS.This issue affects Unlimited Elements For Elementor (Free Widgets, Addons, Templates): from n/a through 2.0.20.
PLUGIN
Unlimited Elements For Elementor
CVE-2026-103344
Risk Score
Threat Entry
Updated 2026-10-06
Unlimited Elements For Elementor - Security Vulnerability (CVE-2026-103342)
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Unlimited Elements Unlimited Elements For Elementor (Free Widgets, Addons, Templates) unlimited-elements-for-elementor allows Reflected XSS.This issue affects Unlimited Elements For Elementor (Free Widgets, Addons, Templates): from n/a through 2.0.20.
PLUGIN
Unlimited Elements For Elementor
CVE-2026-103342
Risk Score
Threat Entry
Updated 2026-10-06
Unlimited Elements for Elementor - Security Vulnerability (CVE-2026-92923)
The Unlimited Elements for Elementor WordPress plugin before 2.0.21 does not sanitise and escape a parameter before using it in a SQL statement, allowing users with a role as low as subscriber to perform blind SQL injection attacks and read arbitrary data from the database. Version 2.0.18 removed the subscriber-level access, so from 2.0.18 onward the issue requires a Contributor role or above.
PLUGIN
Unlimited Elements for Elementor
CVE-2026-92923
Risk Score
Threat Entry
Updated 2026-10-06
Unlimited Elements for Elementor - Security Vulnerability (CVE-2026-85568)
The Unlimited Elements for Elementor WordPress plugin before 2.0.21 does not correctly handle a search value before rewriting an already prepared SQL statement, allowing unauthenticated users to perform SQL injection attacks and to retrieve non-public content, when a related widget option is set away from its default.
PLUGIN
Unlimited Elements for Elementor
CVE-2026-85568
Risk Score
Threat Entry
Updated 2026-10-06
Unlimited Elements for Elementor - Security Vulnerability (CVE-2026-85015)
The Unlimited Elements for Elementor WordPress plugin before 2.0.21 does not sanitise file paths inside uploaded archives before extracting them, allowing authenticated users with access to its asset-management feature (Administrators by default, or Editors when a non-default Unlimited Elements for Elementor WordPress plugin before 2.0.21 setting is enabled) to write arbitrary files, including executable PHP, outside the intended upload directory on servers where the PHP zip extension is unavailable, leading to Remote Code Execution.
PLUGIN
Unlimited Elements for Elementor
CVE-2026-85015
Risk Score
Threat Entry
Updated 2026-10-02
Unlimited Elements for Elementor - Security Vulnerability (CVE-2026-92924)
The Unlimited Elements for Elementor WordPress plugin before 2.0.21 does not check that a request to render widget output comes from a user allowed to make it, allowing users with a role as low as subscriber to have arbitrary WordPress shortcodes executed on the site. Version 2.0.18 removed the subscriber-level access, so from 2.0.18 onward the issue requires a Contributor role or above.
PLUGIN
Unlimited Elements for Elementor
CVE-2026-92924
Risk Score
Threat Entry
Updated 2026-10-02
Unlimited Elements for Elementor - Security Vulnerability (CVE-2026-85016)
The Unlimited Elements for Elementor WordPress plugin before 2.0.21 does not escape an icon value before concatenating it into an HTML attribute in its shared widget-parameter processor, allowing users with Contributor access (who do not hold unfiltered_html) to store a payload that executes when the page is rendered.
PLUGIN
Unlimited Elements for Elementor
CVE-2026-85016
Risk Score
Threat Entry
Updated 2026-10-01
Unlimited Elements For Elementor - Security Vulnerability (CVE-2026-103338)
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Unlimited Elements Unlimited Elements For Elementor (Free Widgets, Addons, Templates) unlimited-elements-for-elementor allows Blind SQL Injection.This issue affects Unlimited Elements For Elementor (Free Widgets, Addons, Templates): from n/a through 2.0.20.
PLUGIN
Unlimited Elements For Elementor
CVE-2026-103338
Risk Score
Threat Entry
Updated 2026-10-01
Unlimited Elements For Elementor - Security Vulnerability (CVE-2026-103341)
Missing Authorization vulnerability in Unlimited Elements Unlimited Elements For Elementor (Free Widgets, Addons, Templates) unlimited-elements-for-elementor allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Unlimited Elements For Elementor (Free Widgets, Addons, Templates): from n/a through 2.0.20.
PLUGIN
Unlimited Elements For Elementor
CVE-2026-103341
Risk Score
Threat Entry
Updated 2026-09-21
Unlimited Elements For Elementor - Security Vulnerability (CVE-2026-85017)
The Unlimited Elements For Elementor WordPress plugin before 2.0.20 does not perform a capability check on an AJAX action and deserializes attacker-controlled stored data through it, which makes it possible for authenticated attackers with subscriber-level access to inject arbitrary PHP objects. A partial fix in the 2.0.18 to 2.0.19 releases raised the privilege required to reach the vulnerable action to editor-level, and the issue was fully resolved in 2.0.20.
PLUGIN
Unlimited Elements For Elementor
CVE-2026-85017
Risk Score
Threat Entry
Updated 2026-09-17
Unlimited Elements For Elementor - Security Vulnerability (CVE-2026-66608)
Contributor Server Side Request Forgery (SSRF) in Unlimited Elements For Elementor (Free Widgets, Addons, Templates)
PLUGIN
Unlimited Elements For Elementor
CVE-2026-66608
Risk Score