Skip to main content

Unlimited Elements EUVDEUVD-2026-43371

| CVE-2026-57718 HIGH
Cross-site Scripting (XSS) (CWE-79)
2026-07-13 Patchstack
XSS Unlimited Elements For Elementor Free Widgets Addons Templates
7.1
CVSS 3.1 · Vendor: Patchstack
Share

Severity by source

Vendor (Patchstack) PRIMARY
7.1 HIGH
AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L
vuln.today AI
7.1 HIGH

Unauthenticated reflected XSS reachable over the network (PR:N/AV:N), requiring a victim click (UI:R), with script escaping into the browser context (S:C) for limited C/I/A impact.

3.1 AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L
4.0 AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N

Primary rating from Vendor (Patchstack).

CVSS VectorVendor: Patchstack

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L
Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
Required
Scope
Changed
Confidentiality
Low
Integrity
Low
Availability
Low

Lifecycle Timeline

2
Analysis Generated
Jul 13, 2026 - 10:46 vuln.today
CVE Published
Jul 13, 2026 - 08:41 cve.org
HIGH 7.1

DescriptionCVE.org

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Unlimited Elements Unlimited Elements For Elementor (Free Widgets, Addons, Templates) unlimited-elements-for-elementor allows Reflected XSS.This issue affects Unlimited Elements For Elementor (Free Widgets, Addons, Templates): from n/a through <= 2.0.12.

AnalysisAI

Reflected cross-site scripting in the Unlimited Elements For Elementor (Free Widgets, Addons, Templates) WordPress plugin affects all versions up to and including 2.0.12, allowing unauthenticated remote attackers to execute arbitrary JavaScript in a victim's browser session when the victim clicks a crafted link. The CVSS 3.1 score of 7.1 reflects a scope change (S:C) where injected script escapes into the victim's browser context, yielding limited confidentiality, integrity, and availability impact. …

Unlock full vulnerability intelligence

  • Risk assessment & exploitation conditions
  • Attack chain visualization
  • Remediation with exact patch versions
  • Threat intelligence from 22 sources
  • Personal watchlist & email alerts
Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access
Craft link with XSS payload in plugin parameter
Delivery
Deliver link via phishing to WordPress user
Exploit
Victim clicks, payload reflected in page
Execution
Script executes in victim browser (site origin)
Impact
Steal session or perform admin actions
Sign in to reveal

Vulnerability AssessmentAI

Exploitation Exploitation requires the attacker to induce a victim to open a maliciously crafted request/link (UI:R in the CVSS vector), so it is not self-propagating and cannot be triggered without human interaction. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment Signals are moderate and internally consistent rather than alarming. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario An attacker crafts a URL targeting a vulnerable plugin endpoint on a victim WordPress site, embedding a malicious JavaScript payload in a reflected request parameter, and delivers it via phishing email or a malicious link. When an authenticated administrator or any logged-in user clicks the link, the script executes in their browser under the site's origin, enabling session/cookie theft, admin-action forgery, or redirection. …
Remediation Upgrade the Unlimited Elements For Elementor plugin to a release newer than 2.0.12; the input data does not specify an exact fixed version, so treat this as 'Patch available per vendor advisory' and confirm the fixed build against the Patchstack advisory (https://patchstack.com/database/Wordpress/Plugin/unlimited-elements-for-elementor/vulnerability/wordpress-unlimited-elements-for-elementor-free-widgets-addons-templates-plugin-2-0-12-cross-site-scripting-xss-vulnerability) and the WordPress.org plugin changelog before deploying. … Detailed patch versions, workarounds, and compensating controls in full report.
Sign in to read full assessment

Recommended ActionAI

Within 24 hours: Audit all WordPress instances to identify systems running Unlimited Elements For Elementor and document installed versions. …

Sign in for detailed remediation steps and compensating controls.

Threat intelligence, references, and detailed analysis are available after sign-in.

More in Unlimited Elements For Elementor Free Widgets Addons Templates

View all
CVE-2024-6170 MEDIUM POC
6.4 Jul 09

The Unlimited Elements For Elementor (Free Widgets, Addons, Templates) plugin for WordPress is vulnerable to Stored Cros
CVE-2024-6169 MEDIUM POC
6.4 Jul 09

The Unlimited Elements For Elementor (Free Widgets, Addons, Templates) plugin for WordPress is vulnerable to Stored Cros
CVE-2024-6166 HIGH
8.8 Jul 09

The Unlimited Elements For Elementor (Free Widgets, Addons, Templates) plugin for WordPress is vulnerable to time-based

CVE-2024-6171 MEDIUM
5.3 Jul 09

The Unlimited Elements For Elementor (Free Widgets, Addons, Templates) plugin for WordPress is vulnerable to IP Address

Same weakness CWE-79 – Cross-site Scripting (XSS)

View all
CVE-2013-7389 MEDIUM POC
4.3
CVE-2021-25299 MEDIUM POC
6.1
CVE-2014-2120 MEDIUM
6.1
CVE-2023-40000 HIGH POC
8.3
CVE-2016-8581 MEDIUM POC
6.1
CVE-2013-5223 MEDIUM POC
5.4
CVE-2025-52367 MEDIUM POC
5.4
CVE-2015-0072 MEDIUM POC
4.3

Same technique XSS

View all
CVE-2017-9248 CRITICAL POC
9.8
CVE-2013-1710 CRITICAL POC
10.0
CVE-2013-7389 MEDIUM POC
4.3
CVE-2021-25299 MEDIUM POC
6.1
CVE-2014-2120 MEDIUM
6.1
CVE-2023-40000 HIGH POC
8.3
CVE-2024-52875 HIGH POC
8.8
CVE-2016-8581 MEDIUM POC
6.1

Share

EUVD-2026-43371 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy