What is the CVSS score of EUVD-2026-91938?

EUVD-2026-91938 has a CVSS 3.1 base score of 6.8 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:N/A:N. EPSS exploitation probability: 0.2%.

Is there a public PoC exploit available for EUVD-2026-91938?

Yes, a public proof-of-concept exploit is available for EUVD-2026-91938. Prioritise patching immediately. EPSS: 0.2%.

Is there a patch available for EUVD-2026-91938?

Yes, a patch is available for EUVD-2026-91938. Update the affected software to the latest version immediately.

Unlimited Elements EUVD-2026-91938

| CVE-2026-85568 MEDIUM

SQL Injection (CWE-89)

2026-10-03 WPScan

GHSA-f222-q2vh-g6q6

WordPress SQLi Unlimited Elements For Elementor Unknown

6.8

CVSS 3.1 · Vendor: WPScan

Severity by source

Vendor (WPScan) PRIMARY

6.8 MEDIUM

AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:N/A:N

vuln.today AI

6.8 MEDIUM

Unauthenticated network SQLi (AV:N/PR:N/UI:N) gated by a non-default option (AC:H); crosses an authorization boundary to read protected data (S:C/C:H), with no write or DoS (I:N/A:N).

3.1 AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:N/A:N

4.0 AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (WPScan).

CVSS VectorVendor: WPScan

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Oct 03, 2026 - 16:26 vuln.today

CVSS changed

Oct 03, 2026 - 16:22 NVD

6.8 (MEDIUM)

Patch available

Oct 03, 2026 - 07:00 EUVD

CVE Published

Oct 03, 2026 - 06:00 cve.org

MEDIUM 6.8

CVE Published

Oct 03, 2026 - 06:00 cve.org

UNKNOWN (no severity yet)

DescriptionCVE.org

The Unlimited Elements for Elementor WordPress plugin before 2.0.21 does not correctly handle a search value before rewriting an already prepared SQL statement, allowing unauthenticated users to perform SQL injection attacks and to retrieve non-public content, when a related widget option is set away from its default.

AnalysisAI

Unauthenticated SQL injection in the WordPress plugin Unlimited Elements for Elementor (versions 1.5.139 through before 2.0.21) allows remote attackers to read non-public content from the site database by supplying a crafted search value that the plugin mishandles when rewriting an already prepared SQL statement. Exploitation is conditional: a related widget option must be set away from its default value for the vulnerable code path to be reachable, which is why the assessed vector carries AC:H despite PR:N and UI:N, and why impact is limited to confidentiality (C:H) with no integrity or availability effect. …

Unlock full vulnerability intelligence

Risk assessment & exploitation conditions
Attack chain visualization
Remediation with exact patch versions
Threat intelligence from 22 sources
Personal watchlist & email alerts

Continue with Google Continue with GitHub

No credit card · 7-day full trial

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access

technique details hidden

Exploit

technique details hidden

Execution

technique details hidden

Impact

technique details hidden

Access

technique details hidden

Exploit

technique details hidden

Execution

technique details hidden

Impact

technique details hidden

Vulnerability AssessmentAI

Exploitation	Exploitation requires that a specific Unlimited Elements for Elementor widget option be set away from its default value; the SQL injection path through the mishandled search value is only reachable in that non-default configuration. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment	Signals are consistent and point to a real but conditional, moderate-priority issue rather than a top-tier emergency. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario	Full exploit scenario with step-by-step reproduction available after sign-in.
Remediation	Vendor-released patch: upgrade Unlimited Elements for Elementor to version 2.0.21 or later, which is the first release that correctly handles the search value and closes the injectable rewrite path; this is the primary and recommended fix, and the WPScan advisory at https://wpscan.com/vulnerability/f4f2c1c5-ced9-44cb-b605-a7ce12ac867f/ should be consulted for the confirmed fixed version and any vendor guidance. … Detailed patch versions, workarounds, and compensating controls in full report.