What is the CVSS score of EUVD-2026-90793?

EUVD-2026-90793 has a CVSS 3.1 base score of 8.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:L. EPSS exploitation probability: 0.2%.

Which versions of Unlimited Elements for Elementor are affected by EUVD-2026-90793?

The WordPress plugin Unlimited Elements for Elementor (versions through 2.0.20) contains a blind SQL injection vulnerability that allows authenticated low-privilege users to read arbitrary database…

How to fix or mitigate EUVD-2026-90793?

Within 24 hours, inventory all WordPress sites to identify installations of the Unlimited Elements for Elementor plugin version 2.0.20 or earlier; if present, immediately restrict the creation of new low-privilege accounts and review existing contributor/subscriber roles to remove untrusted users. Within 7 days, deploy WAF rules to detect and block SQL injection patterns targeting the plugin's parameters, enable database activity monitoring for anomalous queries, and subscribe to the vendor's advisory channel for patch availability. Within 30 days, if no patch is released, plan to replace the plugin with an alternative or isolate affected sites; conduct a security audit of database access logs and rotate database credentials if compromise is suspected.

Unlimited Elements for Elementor EUVD-2026-90793

| CVE-2026-103338 HIGH

SQL Injection (CWE-89)

2026-10-01 Patchstack

GHSA-pvr6-p3c8-gprf

WordPress SQLi Unlimited Elements For Elementor Free Widgets Addons Templates Wordpress Plugin Unlimited Elements

8.5

CVSS 3.1 · Vendor: Patchstack

Severity by source

Vendor (Patchstack) PRIMARY

8.5 HIGH

AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:L

vuln.today AI

7.6 HIGH

Network, low-complexity, low-priv-authenticated SQLi (PR:L) within WordPress's own security authority (S:U, departing from vendor S:C); C:H for full DB read, with minor I:L/A:L plausibility for blind write/heavy-query effects.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:L

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:L/VA:L/SC:N/SI:N/SA:N

Primary rating from Vendor (Patchstack).

CVSS VectorVendor: Patchstack

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

None

Availability

Low

Lifecycle Timeline

Analysis Generated

Oct 01, 2026 - 13:22 vuln.today

CVE Published

Oct 01, 2026 - 12:24 cve.org

HIGH 8.5

DescriptionCVE.org

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Unlimited Elements Unlimited Elements For Elementor (Free Widgets, Addons, Templates) unlimited-elements-for-elementor allows Blind SQL Injection.This issue affects Unlimited Elements For Elementor (Free Widgets, Addons, Templates): from n/a through 2.0.20.

AnalysisAI

Blind SQL injection in the WordPress plugin Unlimited Elements for Elementor (Free Widgets, Addons, Templates) through version 2.0.20 allows an authenticated low-privilege user to read arbitrary data from the site's database by injecting SQL through an unsanitized plugin parameter. Exploitation is network-remote and requires no user interaction, though it does require an account with at least contributor/subscriber-tier privileges (PR:L); because the injection is blind, data extraction is iterative and slower than a direct UNION-based attack but remains reliably automatable. …

Unlock full vulnerability intelligence

Risk assessment & exploitation conditions
Attack chain visualization
Remediation with exact patch versions
Threat intelligence from 22 sources
Personal watchlist & email alerts

Continue with Google Continue with GitHub

No credit card · 7-day full trial

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access

technique details hidden

Delivery

technique details hidden

Exploit

technique details hidden

Execution

technique details hidden

Persist

technique details hidden

Impact

technique details hidden

Access

technique details hidden

Delivery

technique details hidden

Exploit

technique details hidden

Execution

technique details hidden

Persist

technique details hidden

Impact

technique details hidden

Vulnerability AssessmentAI

Exploitation	Requires an authenticated WordPress account with at least low-privilege access (PR:L - e.g., contributor or subscriber-tier user, depending on which plugin endpoint is affected) on a site running Unlimited Elements For Elementor (Free Widgets, Addons, Templates) version 2.0.20 or earlier. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment	This is a genuine, actionable vulnerability with a solid risk profile, though not a drop-everything emergency. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario	Full exploit scenario with step-by-step reproduction available after sign-in.
Remediation	No vendor-released patch version is identified in the available data at time of analysis - this reflects an absence of data rather than confirmation that no fix exists - so administrators should consult the Patchstack advisory at https://patchstack.com/database/wordpress/plugin/unlimited-elements-for-elementor/vulnerability/wordpress-unlimited-elements-for-elementor-free-widgets-addons-templates-plugin-2-0-20-sql-injection-vulnerability?_s_id=cve and the WordPress.org plugin page to confirm the current fixed release, then update the plugin past 2.0.20 and verify the installed version. … Detailed patch versions, workarounds, and compensating controls in full report.

Recommended ActionAI

Within 24 hours, inventory all WordPress sites to identify installations of the Unlimited Elements for Elementor plugin version 2.0.20 or earlier; if present, immediately restrict the creation of new low-privilege accounts and review existing contributor/subscriber roles to remove untrusted users. …

Threat intelligence, references, and detailed analysis are available after sign-in.