EUVD-2026-91215
GHSA-563q-6r48-8247
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
Network-reachable endpoint with low complexity, but requires an authenticated low-privilege account (PR:L); shortcode execution yields limited, site-dependent confidentiality and integrity impact, no availability impact.
Primary rating from Vendor (WPScan).
CVSS VectorVendor: WPScan
Lifecycle Timeline
3DescriptionCVE.org
The Unlimited Elements for Elementor WordPress plugin before 2.0.21 does not check that a request to render widget output comes from a user allowed to make it, allowing users with a role as low as subscriber to have arbitrary WordPress shortcodes executed on the site. Version 2.0.18 removed the subscriber-level access, so from 2.0.18 onward the issue requires a Contributor role or above.
AnalysisAI
Authenticated WordPress users holding a role as low as Subscriber can cause arbitrary shortcodes to be executed on sites running Unlimited Elements for Elementor before 2.0.21, because the plugin's widget-rendering path never verifies that the requester is permitted to invoke it. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N) and our independent assessment keep this at moderate severity: it is an authorization bypass gated behind a low-privileged account, not an unauthenticated code-execution emergency, even though publicly available exploit code exists (WPScan). …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
No credit card · 7-day full trial
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires an authenticated WordPress account on the target site: the CVSS PR:L confirms low privileges are needed. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | This is a moderate-risk, authenticated authorization flaw rather than a critical remote-code-execution emergency, despite the 'RCE' tag. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Vendor-released patch: upgrade Unlimited Elements for Elementor to 2.0.21 or later, which is the first version outside the vulnerable range; this is the only complete fix and should be applied to every WordPress instance carrying the plugin. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
Stored cross-site scripting in the Unlimited Elements For Elementor WordPress plugin (all versions before 2.0.11) lets a
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Unlimited Elements
PHP object injection in the Unlimited Elements For Elementor WordPress plugin (versions before 2.0.20) lets authenticate
Unauthenticated SQL injection in the WordPress plugin Unlimited Elements for Elementor (versions 1.5.139 through before
Authenticated path traversal in the Unlimited Elements for Elementor WordPress plugin before 2.0.21 lets a privileged us
Blind SQL injection in the Unlimited Elements for Elementor WordPress plugin (all releases before 2.0.21) allows an auth
The Unlimited Elements For Elementor (Free Widgets, Addons, Templates) plugin for WordPress is vulnerable to Remote Code
Unrestricted Upload of File with Dangerous Type vulnerability in Unlimited Elements Unlimited Elements For Elementor (Fr
Unrestricted Upload of File with Dangerous Type vulnerability in Unlimited Elements Unlimited Elements For Elementor (Fr
Deserialization of Untrusted Data vulnerability in Unlimited Elements Unlimited Elements For Elementor (Free Widgets, Ad
The Unlimited Elements For Elementor (Free Widgets, Addons, Templates) plugin for WordPress is vulnerable to blind SQL I
The Unlimited Elements For Elementor (Free Widgets, Addons, Templates) plugin for WordPress is vulnerable to SQL Injecti
Share
External POC / Exploit Code
Leaving vuln.today