Live Vulnerability Intelligence
Threat Database
Search CVEs, inspect descriptions, and open detail pages with AI-assisted technical context.
Threat Entry
Updated 2026-09-11
Unlimited Elements For Elementor - Cross-Site Scripting (XSS) (CVE-2026-77150)
The Unlimited Elements For Elementor plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via 'data[name]' Parameter in all versions up to, and including, 2.0.16 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link. The show_preview AJAX action is registered for unauthenticated users and is gated only by a nonce, which an unauthenticated attacker can retrieve by loading…
PLUGIN
Unlimited Elements For Elementor
CVE-2026-77150
Risk Score
Threat Entry
Updated 2026-09-11
Unlimited Elements For Elementor - SQL Injection (CVE-2026-18561)
The Unlimited Elements For Elementor plugin for WordPress is vulnerable to SQL Injection via the 'addontype' parameter in versions up to, and including, 2.0.16. This is due to insufficient escaping on the user-supplied parameter and the lack of sufficient preparation on the existing SQL query in the getWhereString() function; when the parameter is supplied as an array, element zero is used verbatim as the SQL comparison operator and concatenated into the WHERE clause without sanitization, while normalizeAjaxInputData() strips WordPress's magic_quotes protection from the value. This makes it possible for unauthenticated…
PLUGIN
Unlimited Elements For Elementor
CVE-2026-18561
Risk Score
Threat Entry
Updated 2026-09-08
Unlimited Elements For Elementor - Cross-Site Scripting (XSS) (CVE-2026-84820)
Unauthenticated Cross Site Scripting (XSS) in Unlimited Elements For Elementor (Free Widgets, Addons, Templates)
PLUGIN
Unlimited Elements For Elementor
CVE-2026-84820
Risk Score
Threat Entry
Updated 2026-09-08
Unlimited Elements For Elementor - Cross-Site Scripting (XSS) (CVE-2026-75586)
The Unlimited Elements For Elementor plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via 'formData[id]' Parameter in all versions up to, and including, 2.0.17 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link. The front-end AJAX handler is registered on the public 'wp' action with no nonce, capability, or referer check, and the raw attacker-controlled id value…
PLUGIN
Unlimited Elements For Elementor
CVE-2026-75586
Risk Score
Threat Entry
Updated 2026-07-21
Unlimited Elements For Elementor - Cross-Site Scripting (XSS) (CVE-2026-10081)
The Unlimited Elements For Elementor WordPress plugin before 2.0.11 does not sanitize or escape Google review content fetched from the Serp API before rendering it in the Google Reviews widget output, allowing unauthenticated attackers who submit a malicious review on the targeted business's Google listing to deliver Stored XSS to any visitor (including administrators) of any WP page displaying that Place ID's reviews.
PLUGIN
Unlimited Elements For Elementor
CVE-2026-10081
Risk Score
Threat Entry
Updated 2026-06-17
Unlimited Elements For Elementor - SQL Injection (CVE-2026-5486)
The Unlimited Elements for Elementor plugin for WordPress is vulnerable to SQL Injection via the 'data[filter_search]' parameter in the get_cat_addons AJAX action in versions up to and including 2.0.7. This is due to insufficient input sanitization and the use of deprecated escaping functions combined with direct string concatenation in SQL query construction. The vulnerability is exacerbated because the normalizeAjaxInputData() function calls stripslashes() on all user input, removing the protection provided by WordPress's wp_magic_quotes() function. Subsequently, the filter_search parameter is escaped using the deprecated wpdb->_escape() function and then directly concatenated into…
PLUGIN
Unlimited Elements For Elementor
CVE-2026-5486
Risk Score
Threat Entry
Updated 2026-06-17
Unlimited Elements For Elementor - Cross-Site Scripting (XSS) (CVE-2024-13362)
Multiple plugins and/or themes for WordPress are vulnerable to Reflected Cross-Site Scripting via the url parameter in various versions due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
PLUGIN
Unlimited Elements For Elementor
CVE-2024-13362
Risk Score
Threat Entry
Updated 2026-06-17
Unlimited Elements For Elementor - Path Traversal (CVE-2026-4659)
The Unlimited Elements for Elementor plugin for WordPress is vulnerable to Arbitrary File Read via the Repeater JSON/CSV URL parameter in versions up to, and including, 2.0.6. This is due to insufficient path traversal sanitization in the URLtoRelative() and urlToPath() functions, combined with the ability to enable debug output in widget settings. The URLtoRelative() function only performs a simple string replacement to remove the site's base URL without sanitizing path traversal sequences (../), and the cleanPath() function only normalizes directory separators without removing traversal components. This allows an attacker to…
PLUGIN
Unlimited Elements For Elementor
CVE-2026-4659
Risk Score
Threat Entry
Updated 2026-06-17
Unlimited Elements For Elementor - Cross-Site Scripting (XSS) (CVE-2026-2724)
The Unlimited Elements for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the form entry fields in all versions up to, and including, 2.0.5. This is due to insufficient input sanitization and output escaping on form submission data displayed in the admin Form Entries Trash view. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever an administrator views the trashed form entries.
PLUGIN
Unlimited Elements For Elementor
CVE-2026-2724
Risk Score
Threat Entry
Updated 2026-06-17
Unlimited Elements For Elementor - Cross-Site Scripting (XSS) (CVE-2025-14274)
The Unlimited Elements for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Border Hero widget's Button Link field in versions up to 2.0.1. This is due to insufficient input sanitization and output escaping on user-supplied URLs. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
PLUGIN
Unlimited Elements For Elementor
CVE-2025-14274
Risk Score
Threat Entry
Updated 2026-06-17
Unlimited Elements For Elementor - Arbitrary File Upload (CVE-2025-13692)
The Unlimited Elements For Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up to, and including, 2.0 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses the SVG file. A form with a file upload field must be created with the premium version of the plugin in order to exploit the vulnerability. However, once the form exists, the vulnerability is exploitable…
PLUGIN
Unlimited Elements For Elementor
CVE-2025-13692
Risk Score
Threat Entry
Updated 2026-06-17
Unlimited Elements For Elementor - Cross-Site Scripting (XSS) (CVE-2025-8603)
The Unlimited Elements For Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via several widgets in all versions up to, and including, 1.5.148 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
PLUGIN
Unlimited Elements For Elementor
CVE-2025-8603
Risk Score
Threat Entry
Updated 2026-06-17
Unlimited Elements For Elementor - Cross-Site Scripting (XSS) (CVE-2025-1663)
The Unlimited Elements For Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via several widgets in all versions up to, and including, 1.5.142 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
PLUGIN
Unlimited Elements For Elementor
CVE-2025-1663
Risk Score
Threat Entry
Updated 2026-06-17
Unlimited Elements For Elementor - Cross-Site Scripting (XSS) (CVE-2024-13155)
The Unlimited Elements For Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Transparent Split Hero widget in all versions up to, and including, 1.5.140 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Note: Since the widget code isn't part of the code base, to apply the patch, the affected widget: Transparent Split…
PLUGIN
Unlimited Elements For Elementor
CVE-2024-13155
Risk Score
Threat Entry
Updated 2026-06-17
Unlimited Elements For Elementor - Cross-Site Scripting (XSS) (CVE-2024-13153)
The Unlimited Elements For Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via multiple widgets in all versions up to, and including, 1.5.135 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Note: Since the widget code isn't part of the code base, to apply the patch, the affected widgets: Image Tooltip, Notification, Simple Popup, Video…
PLUGIN
Unlimited Elements For Elementor
CVE-2024-13153
Risk Score
Threat Entry
Updated 2026-06-17
Unlimited Elements For Elementor - Cross-Site Scripting (XSS) (CVE-2024-10784)
The Unlimited Elements For Elementor (Free Widgets, Addons, Templates) plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘Tile Gallery' widget in all versions up to, and including, 1.5.126 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
PLUGIN
Unlimited Elements For Elementor
CVE-2024-10784
Risk Score
Threat Entry
Updated 2026-06-17
Unlimited Elements For Elementor - PHP Object Injection (CVE-2024-49271)
Deserialization of Untrusted Data vulnerability in Unlimited Elements Unlimited Elements For Elementor (Free Widgets, Addons, Templates) unlimited-elements-for-elementor allows Command Injection.This issue affects Unlimited Elements For Elementor (Free Widgets, Addons, Templates): from n/a through
PLUGIN
Unlimited Elements For Elementor
CVE-2024-49271
Risk Score
Threat Entry
Updated 2026-06-17
Unlimited Elements For Elementor - Cross-Site Request Forgery (CSRF) (CVE-2022-4974)
The Freemius SDK, as used by hundreds of WordPress plugin and theme developers, was vulnerable to Cross-Site Request Forgery and Information disclosure due to missing capability checks and nonce protection on the _get_debug_log, _get_db_option, and the _set_db_option functions in versions up to, and including 2.4.2. Any WordPress plugin or theme running a version of Freemius less than 2.4.3 is vulnerable.
PLUGIN
Unlimited Elements For Elementor
CVE-2022-4974
Risk Score
Threat Entry
Updated 2026-06-17
Unlimited Elements For Elementor - Cross-Site Scripting (XSS) (CVE-2024-45454)
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Unlimited Elements Unlimited Elements For Elementor (Free Widgets, Addons, Templates) unlimited-elements-for-elementor allows Reflected XSS.This issue affects Unlimited Elements For Elementor (Free Widgets, Addons, Templates): from n/a through
PLUGIN
Unlimited Elements For Elementor
CVE-2024-45454
Risk Score
Threat Entry
Updated 2026-06-17
Unlimited Elements For Elementor - Security Vulnerability (CVE-2024-6171)
The Unlimited Elements For Elementor (Free Widgets, Addons, Templates) plugin for WordPress is vulnerable to IP Address Spoofing in all versions up to, and including, 1.5.112 due to insufficient IP address validation and/or use of user-supplied HTTP headers as a primary method for IP retrieval. This makes it possible for unauthenticated attackers to bypass antispam functionality in the Form Builder widgets.
PLUGIN
Unlimited Elements For Elementor
CVE-2024-6171
Risk Score