What is the CVSS score of CVE-2026-57718?

CVE-2026-57718 has a CVSS 3.1 base score of 7.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L. EPSS exploitation probability: 0.3%.

Which versions of Unlimited Elements are affected by CVE-2026-57718?

Unlimited Elements For Elementor WordPress plugin versions through 2.0.12 contain a reflected cross-site scripting vulnerability (CVE-2026-57718, CVSS 7.1) that allows attackers to inject malicious…

How to fix or mitigate CVE-2026-57718?

Within 24 hours: Audit all WordPress instances to identify systems running Unlimited Elements For Elementor and document installed versions. Within 7 days: Notify all website administrators of the vulnerability in Unlimited Elements For Elementor (CVE-2026-57718) affecting versions up to 2.0.12, advise staff to avoid clicking external links on affected sites, and contact the plugin vendor to confirm patch timeline. Within 30 days: Implement content security policy (CSP) headers to block inline script execution as a compensating control; evaluate alternative plugins with active security maintenance; consider disabling Unlimited Elements For Elementor if not mission-critical; reassess vendor patch availability and plan upgrade timeline once released.

Unlimited Elements CVE-2026-57718

EUVD-2026-43371 HIGH

Cross-site Scripting (XSS) (CWE-79)

2026-07-13 Patchstack

WordPress XSS Unlimited Elements For Elementor Free Widgets Addons Templates Wordpress Plugin Unlimited Elements

7.1

CVSS 3.1 · Vendor: Patchstack

Severity by source

Vendor (Patchstack) PRIMARY

7.1 HIGH

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L

vuln.today AI

7.1 HIGH

Unauthenticated reflected XSS reachable over the network (PR:N/AV:N), requiring a victim click (UI:R), with script escaping into the browser context (S:C) for limited C/I/A impact.

3.1 AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L

4.0 AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N

Primary rating from Vendor (Patchstack).

CVSS VectorVendor: Patchstack

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

Low

Lifecycle Timeline

Analysis Generated

Jul 13, 2026 - 10:46 vuln.today

CVE Published

Jul 13, 2026 - 08:41 cve.org

HIGH 7.1

DescriptionCVE.org

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Unlimited Elements Unlimited Elements For Elementor (Free Widgets, Addons, Templates) unlimited-elements-for-elementor allows Reflected XSS.This issue affects Unlimited Elements For Elementor (Free Widgets, Addons, Templates): from n/a through <= 2.0.12.

AnalysisAI

Reflected cross-site scripting in the Unlimited Elements For Elementor (Free Widgets, Addons, Templates) WordPress plugin affects all versions up to and including 2.0.12, allowing unauthenticated remote attackers to execute arbitrary JavaScript in a victim's browser session when the victim clicks a crafted link. The CVSS 3.1 score of 7.1 reflects a scope change (S:C) where injected script escapes into the victim's browser context, yielding limited confidentiality, integrity, and availability impact. No public exploit has been identified at time of analysis and the flaw is not listed in CISA KEV; the issue was reported by Patchstack.

Technical ContextAI

The vulnerability is CWE-79 (Improper Neutralization of Input During Web Page Generation), the classic root cause of cross-site scripting: user-supplied input is reflected back into an HTML response without adequate output encoding or contextual sanitization. The affected component is the Unlimited Elements For Elementor plugin (CPE cpe:2.3:a:unlimited_elements:unlimited_elements_for_elementor_(free_widgets,_addons,_templates):*), a page-builder add-on for the Elementor ecosystem on WordPress that supplies widgets, addons, and templates. Because this is a *reflected* variant, the malicious payload is not stored server-side but is echoed from a request parameter into the rendered page, so exploitation requires the victim to be lured into issuing the crafted request (UI:R).

RemediationAI

Upgrade the Unlimited Elements For Elementor plugin to a release newer than 2.0.12; the input data does not specify an exact fixed version, so treat this as 'Patch available per vendor advisory' and confirm the fixed build against the Patchstack advisory (https://patchstack.com/database/Wordpress/Plugin/unlimited-elements-for-elementor/vulnerability/wordpress-unlimited-elements-for-elementor-free-widgets-addons-templates-plugin-2-0-12-cross-site-scripting-xss-vulnerability) and the WordPress.org plugin changelog before deploying. Until a confirmed patched version is applied, deploy a Web Application Firewall (a Patchstack or comparable WordPress WAF virtual patch) to filter XSS payloads in request parameters handled by the plugin, and add a restrictive Content-Security-Policy header to limit inline-script execution - noting CSP can break legitimate inline scripts used by page-builder themes and requires testing. As a last resort, deactivate the plugin entirely, accepting the trade-off that Elementor pages built with its widgets will lose functionality.