EUVD-2026-72643
GHSA-pmv9-cx7p-8m6f
Severity by source
AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L
Unauthenticated network XSS with scope change affecting victim browser session; A:N because XSS does not credibly impair service availability.
Primary rating from Vendor (Patchstack).
CVSS VectorVendor: Patchstack
Lifecycle Timeline
2DescriptionCVE.org
Unauthenticated Cross Site Scripting (XSS) in Unlimited Elements For Elementor (Free Widgets, Addons, Templates) <= 2.0.17 versions.
Articles & Coverage 2
AnalysisAI
Cross-site scripting in Unlimited Elements For Elementor (Free Widgets, Addons, Templates) versions up to and including 2.0.17 allows unauthenticated attackers to inject malicious scripts that execute in the browser context of site visitors or privileged WordPress users. The CVSS 7.1 rating reflects a scope change (S:C), meaning the injected payload escapes the plugin's own origin and can compromise administrator browser sessions. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires: (1) the target WordPress site has Unlimited Elements For Elementor installed and active in version <= 2.0.17; (2) an attacker can reach a plugin-handled input endpoint without any WordPress authentication (PR:N confirmed by CVSS vector); (3) a victim - most critically a logged-in WordPress administrator or privileged user - subsequently loads the page or Elementor element containing the injected payload (UI:R). … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 7.1 base score is driven by network reachability (AV:N), low attack complexity (AC:L), no authentication requirement (PR:N), required user interaction (UI:R), and scope change (S:C) - a realistic profile for stored or reflected XSS in a widely deployed WordPress plugin. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | The primary remediation is to update the Unlimited Elements For Elementor plugin to a version beyond 2.0.17; the Patchstack advisory (https://patchstack.com/database/wordpress/plugin/unlimited-elements-for-elementor/vulnerability/wordpress-unlimited-elements-for-elementor-free-widgets-addons-templates-plugin-2-0-17-cross-site-scripting-xss-vulnerability) should be consulted to confirm the exact patched release, as no specific fixed version number is independently confirmed in the available data. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, identify all WordPress installations using Unlimited Elements For Elementor and audit their versions; immediately disable the plugin if running version 2.0.17 or earlier to prevent XSS attacks reaching site administrators. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
The Unlimited Elements For Elementor (Free Widgets, Addons, Templates) plugin for WordPress is vulnerable to Stored Cros
The Unlimited Elements For Elementor (Free Widgets, Addons, Templates) plugin for WordPress is vulnerable to Stored Cros
The Unlimited Elements For Elementor (Free Widgets, Addons, Templates) plugin for WordPress is vulnerable to time-based
Reflected cross-site scripting in the Unlimited Elements For Elementor (Free Widgets, Addons, Templates) WordPress plugi
Arbitrary file download via path traversal in the Unlimited Elements For Elementor WordPress plugin (versions ≤ 2.0.14)
Broken access control in the Unlimited Elements For Elementor WordPress plugin (versions through 2.0.15) permits authent
The Unlimited Elements For Elementor (Free Widgets, Addons, Templates) plugin for WordPress is vulnerable to IP Address
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today