What is the CVSS score of EUVD-2026-94488?

EUVD-2026-94488 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.3%.

Which versions of Unlimited Elements are affected by EUVD-2026-94488?

The Unlimited Elements For Elementor WordPress plugin (versions through 2.0.19) contains a high-severity object injection flaw that could let an authenticated low-privilege user compromise site data,…

How to fix or mitigate EUVD-2026-94488?

Within 24 hours, inventory all WordPress sites for Unlimited Elements For Elementor versions through 2.0.19, disable self-registration where not required, and audit or remove unused low-privilege accounts; if the plugin is non-essential, consider temporarily deactivating it. Within 7 days, deploy WAF/virtual-patching rules to block PHP object injection and suspicious deserialization traffic, restrict subscriber-level access, monitor WordPress and web server logs for exploitation attempts, and check the vendor advisory for an updated fixed version. Within 30 days, upgrade to the vendor-released patched version once available, or replace/retire the plugin if no vendor fix becomes available; complete a compromise assessment, enforce least privilege for all WordPress roles, and maintain ongoing monitoring until the affected plugin version is no longer in use.

Unlimited Elements EUVD-2026-94488

| CVE-2026-95534 HIGH

Deserialization of Untrusted Data (CWE-502)

2026-10-07 Patchstack

GHSA-5v8m-ppqr-qj2h

WordPress Deserialization Unlimited Elements For Elementor Free Widgets Addons Templates Wordpress Plugin Unlimited Elements

8.8

CVSS 3.1 · Vendor: Patchstack

Severity by source

Vendor (Patchstack) PRIMARY

8.8 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

8.8 HIGH

Network-reachable plugin endpoint (AV:N), no special preconditions (AC:L), but low-privilege authentication is required (PR:L); object injection can fully compromise the site (C/I/A:H).

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (Patchstack).

CVSS VectorVendor: Patchstack

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Oct 07, 2026 - 17:36 vuln.today

CVE Published

Oct 07, 2026 - 17:00 cve.org

HIGH 8.8

DescriptionCVE.org

Deserialization of Untrusted Data vulnerability in Unlimited Elements Unlimited Elements For Elementor (Free Widgets, Addons, Templates) allows Object Injection.

This issue affects Unlimited Elements For Elementor (Free Widgets, Addons, Templates): from n/a through 2.0.19.

AnalysisAI

PHP object injection in the WordPress plugin Unlimited Elements For Elementor (Free Widgets, Addons, Templates) through version 2.0.19 lets an authenticated low-privilege user pass attacker-controlled data into an unsafe PHP deserialization path, resulting in high confidentiality, integrity, and availability impact per the vendor-assigned CVSS 3.1 score of 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). Exploitation requires a logged-in WordPress account with at least low privileges on a site running an affected plugin version, and no end-user interaction is needed; realistic exploitation further depends on the presence of a usable POP gadget chain in the plugin, Elementor, or WordPress core, which is not confirmed by the available data. …

Unlock full vulnerability intelligence

Risk assessment & exploitation conditions
Attack chain visualization
Remediation with exact patch versions
Threat intelligence from 22 sources
Personal watchlist & email alerts

Continue with Google Continue with GitHub

No credit card · 7-day full trial

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access

technique details hidden

Delivery

technique details hidden

Exploit

technique details hidden

Execution

technique details hidden

Persist

technique details hidden

Impact

technique details hidden

Access

technique details hidden

Delivery

technique details hidden

Exploit

technique details hidden

Execution

technique details hidden

Persist

technique details hidden

Impact

technique details hidden

Vulnerability AssessmentAI

Exploitation	Exploitation requires an authenticated WordPress account with at least low privileges (CVSS PR:L) on a site running Unlimited Elements For Elementor (Free Widgets, Addons, Templates) version n/a through 2.0.19; no end-user interaction is needed (UI:N). … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment	This is a PHP Object Injection flaw (CWE-502) in a popular WordPress/Elementor plugin, carrying a vendor (Patchstack) CVSS 3.1 score of 8.8 with vector AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario	Full exploit scenario with step-by-step reproduction available after sign-in.
Remediation	No vendor-released patch version is identified in the available data, so the primary action is to check the Patchstack advisory (https://patchstack.com/database/wordpress/plugin/unlimited-elements-for-elementor/vulnerability/wordpress-unlimited-elements-for-elementor-free-widgets-addons-templates-plugin-2-0-19-php-object-injection-vulnerability?_s_id=cve) and the plugin's WordPress.org page for the first fixed release, then update the plugin as soon as one is published and confirm the installed version moves beyond 2.0.19. … Detailed patch versions, workarounds, and compensating controls in full report.

Recommended ActionAI

Within 24 hours, inventory all WordPress sites for Unlimited Elements For Elementor versions through 2.0.19, disable self-registration where not required, and audit or remove unused low-privilege accounts; if the plugin is non-essential, consider temporarily deactivating it. …

Threat intelligence, references, and detailed analysis are available after sign-in.