Skip to main content

Unlimited Elements For Elementor CVE-2024-49271

CRITICAL
Improper Neutralization of Script in Attributes of IMG Tags in a Web Page (CWE-82)
2024-10-16 audit@patchstack.com
WordPress Deserialization Command Injection Unlimited Elements For Elementor Wordpress Plugin Elementor Unlimited Elements
9.1
CVSS 3.1 · NVD
Share

Severity by source

NVD PRIMARY
9.1 CRITICAL
AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector
Network
Attack Complexity
Low
Privileges Required
High
User Interaction
None
Scope
Changed
Confidentiality
High
Integrity
High
Availability
High

Lifecycle Timeline

4
Severity Changed
Apr 23, 2026 - 15:22 NVD
HIGH CRITICAL
CVSS changed
Apr 23, 2026 - 15:22 NVD
7.2 (HIGH) 9.1 (CRITICAL)
CVE Published
Oct 16, 2024 - 13:15 nvd
HIGH 7.2
CVE Published
Oct 16, 2024 - 13:15 cve.org
CRITICAL 9.1

DescriptionCVE.org

Deserialization of Untrusted Data vulnerability in Unlimited Elements Unlimited Elements For Elementor (Free Widgets, Addons, Templates) unlimited-elements-for-elementor allows Command Injection.This issue affects Unlimited Elements For Elementor (Free Widgets, Addons, Templates): from n/a through <= 1.5.121.

AnalysisAI

Deserialization of Untrusted Data vulnerability in Unlimited Elements Unlimited Elements For Elementor (Free Widgets, Addons, Templates) unlimited-elements-for-elementor allows Command. Rated critical severity (CVSS 9.1), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.

Technical ContextAI

This vulnerability is classified under CWE-82. Deserialization of Untrusted Data vulnerability in Unlimited Elements Unlimited Elements For Elementor (Free Widgets, Addons, Templates) unlimited-elements-for-elementor allows Command Injection.5.121. Affected products include: Unlimited-Elements Unlimited Elements For Elementor.

RemediationAI

No vendor patch is available at time of analysis. Monitor vendor advisories for updates. Apply vendor patches when available. Implement network segmentation and monitoring as interim mitigations.

More in Unlimited Elements For Elementor

View all
CVE-2026-10081 HIGH POC
8.8 Jul 20

Stored cross-site scripting in the Unlimited Elements For Elementor WordPress plugin (all versions before 2.0.11) lets a
CVE-2024-29792 HIGH POC
7.1 Mar 27

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Unlimited Elements
CVE-2023-6743 HIGH
8.8 May 29

The Unlimited Elements For Elementor (Free Widgets, Addons, Templates) plugin for WordPress is vulnerable to Remote Code
CVE-2023-31090 CRITICAL
9.9 Apr 24

Unrestricted Upload of File with Dangerous Type vulnerability in Unlimited Elements Unlimited Elements For Elementor (Fr
CVE-2023-31231 CRITICAL
9.9 Dec 20

Unrestricted Upload of File with Dangerous Type vulnerability in Unlimited Elements Unlimited Elements For Elementor (Fr
CVE-2024-5329 HIGH
8.8 Jun 06

The Unlimited Elements For Elementor (Free Widgets, Addons, Templates) plugin for WordPress is vulnerable to blind SQL I
CVE-2024-4779 HIGH
8.8 May 23

The Unlimited Elements For Elementor (Free Widgets, Addons, Templates) plugin for WordPress is vulnerable to SQL Injecti
CVE-2024-3055 HIGH
8.8 May 14

The Unlimited Elements For Elementor (Free Widgets, Addons, Templates) plugin for WordPress is vulnerable to time-based

CVE-2023-3295 HIGH
8.8 Jun 17

The Unlimited Elements For Elementor (Free Widgets, Addons, Templates) for WordPress is vulnerable to arbitrary file upl
CVE-2026-48837 HIGH
8.5 May 25

Blind SQL injection in the Unlimited Elements For Elementor WordPress plugin (versions up to and including 2.0.8) allows
CVE-2024-2662 HIGH
7.2 May 14

The Unlimited Elements For Elementor (Free Widgets, Addons, Templates) plugin for WordPress is vulnerable to command inj
CVE-2026-18561 HIGH
7.5 Sep 11

Unauthenticated SQL injection in the Unlimited Elements For Elementor WordPress plugin (versions ≤2.0.16) allows remote

Same weakness CWE-82 – Improper Neutralization of Script in Attributes of IMG Tags in a Web Page

View all
CVE-2024-52427 CRITICAL
9.9
CVE-2024-48042 CRITICAL
9.1
CVE-2024-52434 CRITICAL
9.1
CVE-2024-52393 CRITICAL
9.1
CVE-2023-30963 MEDIUM
5.4

Same technique Deserialization

View all
CVE-2015-7450 CRITICAL POC
9.8
CVE-2025-53770 CRITICAL POC
9.8
CVE-2020-7961 CRITICAL POC
9.8
CVE-2021-42237 CRITICAL POC
9.8
CVE-2025-24016 CRITICAL POC
9.9
CVE-2020-0618 HIGH POC
8.8
CVE-2015-4852 CRITICAL POC
9.8
CVE-2025-49113 CRITICAL POC
9.9

Share

CVE-2024-49271 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy