What is the CVSS score of EUVD-2026-92028?

EUVD-2026-92028 has a CVSS 3.1 base score of 7.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L. EPSS exploitation probability: 0.1%.

Which versions of Unlimited Elements are affected by EUVD-2026-92028?

The Unlimited Elements for Elementor WordPress plugin (up to version 2.0.20) has a reflected cross-site scripting vulnerability that could allow attackers to hijack user sessions, steal credentials,…

How to fix or mitigate EUVD-2026-92028?

Within 24 hours, inventory all WordPress installations to identify any using the Unlimited Elements for Elementor plugin version 2.0.20 or earlier; if the plugin is not business-critical, deactivate and remove it immediately. If it must remain active, deploy a web application firewall (WAF) with rules to block reflected XSS attempts and instruct users to avoid clicking suspicious links. Within 7 days, apply virtual patching via WAF if available and enable detailed logging to monitor for exploitation attempts. Within 30 days, evaluate alternative plugins, and apply the vendor patch as soon as it is released; if no patch is forthcoming, consider permanently removing the plugin or isolating affected sites.

Unlimited Elements EUVD-2026-92028

| CVE-2026-103342 HIGH

Cross-site Scripting (XSS) (CWE-79)

2026-10-03 Patchstack

GHSA-j3m5-w9gh-35hx

WordPress XSS Unlimited Elements For Elementor Free Widgets Addons Templates Wordpress Plugin Unlimited Elements

7.1

CVSS 3.1 · Vendor: Patchstack

Severity by source

Vendor (Patchstack) PRIMARY

7.1 HIGH

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L

vuln.today AI

6.1 MEDIUM

Remote unauthenticated reflected XSS needing victim click (UI:R), scope-changed into the browser (S:C), with low C/I impact; availability not realistically affected so A:N.

3.1 AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N

Primary rating from Vendor (Patchstack).

CVSS VectorVendor: Patchstack

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

Low

Lifecycle Timeline

Analysis Generated

Oct 03, 2026 - 15:16 vuln.today

CVE Published

Oct 03, 2026 - 14:00 cve.org

HIGH 7.1

DescriptionCVE.org

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Unlimited Elements Unlimited Elements For Elementor (Free Widgets, Addons, Templates) unlimited-elements-for-elementor allows Reflected XSS.This issue affects Unlimited Elements For Elementor (Free Widgets, Addons, Templates): from n/a through 2.0.20.

AnalysisAI

Reflected cross-site scripting in the Unlimited Elements for Elementor WordPress plugin up to version 2.0.20 allows unauthenticated remote attackers to execute arbitrary scripts in the browser of a victim who clicks a specially crafted link, potentially leading to session hijacking, credential theft, or unauthorized actions performed as the victim. Exploitation requires user interaction and is limited to per-victim social engineering because the payload is not stored; no public exploit code or active exploitation has been identified at time of analysis. …

Unlock full vulnerability intelligence

Risk assessment & exploitation conditions
Attack chain visualization
Remediation with exact patch versions
Threat intelligence from 22 sources
Personal watchlist & email alerts

Continue with Google Continue with GitHub

No credit card · 7-day full trial

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access

technique details hidden

Delivery

technique details hidden

Exploit

technique details hidden

Execution

technique details hidden

Impact

technique details hidden

Access

technique details hidden

Delivery

technique details hidden

Exploit

technique details hidden

Execution

technique details hidden

Impact

technique details hidden

Vulnerability AssessmentAI

Exploitation	Exploitation requires the attacker to trick a victim into clicking a specially crafted link or visiting a malicious page (CVSS UI:R), so it cannot be triggered silently against default traffic. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment	This is a moderate-severity reflected cross-site scripting (CWE-79) flaw with a CVSS 3.1 score of 7.1 (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L). … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario	Full exploit scenario with step-by-step reproduction available after sign-in.
Remediation	No fixed version is specified in the available data; consult the Patchstack advisory for an updated release beyond 2.0.20. … Detailed patch versions, workarounds, and compensating controls in full report.

Recommended ActionAI

Within 24 hours, inventory all WordPress installations to identify any using the Unlimited Elements for Elementor plugin version 2.0.20 or earlier; if the plugin is not business-critical, deactivate and remove it immediately. …

Threat intelligence, references, and detailed analysis are available after sign-in.