Unlimited Elements For Elementor
Monthly
PHP object injection in the Unlimited Elements For Elementor WordPress plugin (versions before 2.0.20) lets authenticated attackers with subscriber-level access inject arbitrary PHP objects through an AJAX action that lacks a capability check and deserializes stored data. Exploitation requires open user registration (or any low-privilege account), and full impact-such as remote code execution or file/database manipulation-depends on a usable PHP POP gadget chain being loaded by WordPress core, Elementor, or another active plugin (hence the AC:H rating). Publicly available exploit code exists, though no confirmed active exploitation (CISA KEV) has been reported; the 2.0.18-2.0.19 releases only partially mitigate by raising the required privilege to editor-level.
Unauthenticated SQL injection in the Unlimited Elements For Elementor WordPress plugin (versions ≤2.0.16) allows remote attackers to extract sensitive data from the WordPress database without any credentials. The flaw exists in getWhereString() where the 'addontype' parameter, when submitted as an array, has its first element injected verbatim as the SQL comparison operator into the WHERE clause; the companion normalizeAjaxInputData() method strips WordPress's built-in magic_quotes protection, eliminating the last layer of defense. No public exploit or KEV listing has been identified at time of analysis, but the unauthenticated network attack path and confirmed Wordfence disclosure make this a credible priority for sites running the affected plugin.
Stored cross-site scripting in the Unlimited Elements For Elementor WordPress plugin (all versions before 2.0.11) lets an unauthenticated attacker plant a malicious Google review on a targeted business's Google listing that, once fetched via the Serp API and rendered unescaped in the Google Reviews widget, executes JavaScript in the browser of every visitor — including logged-in administrators — of any page showing that Place ID's reviews. Publicly available exploit code exists and the vendor has shipped a fix, but there is no public exploit identified as being used in active attacks. The injection is delivered through third-party review content rather than a direct request to the WordPress site, making it a supply-chain-style stored XSS.
Blind SQL injection in the Unlimited Elements For Elementor WordPress plugin (versions up to and including 2.0.8) allows authenticated low-privilege attackers to inject arbitrary SQL into backend database queries. The flaw was reported by Patchstack and carries a CVSS 3.1 score of 8.5 due to scope change and high confidentiality impact, though no public exploit identified at time of analysis and EPSS probability remains low at 0.03%. The scope change (S:C) indicates the injection crosses a trust boundary, amplifying impact beyond the vulnerable component.
Path traversal in Unlimited Elements for Elementor (WordPress plugin ≤2.0.6) enables authenticated attackers with Author-level privileges to read arbitrary files from the web server via crafted URLs in the Repeater JSON/CSV URL parameter. The vulnerability chains multiple sanitization failures in URLtoRelative(), urlToPath(), and cleanPath() functions, allowing traversal sequences like ../../../../etc/passwd to bypass domain-stripping logic and access sensitive files including wp-config.php. CVSS 7.5 indicates high confidentiality impact. EPSS and KEV data not provided; no public exploit confirmed at time of analysis. Wordfence reports the issue with detailed code references to vulnerable functions in versions through 2.0.6.
Blind SQL injection in the Unlimited Elements for Elementor WordPress plugin (all releases before 2.0.21) allows an authenticated attacker to pass a crafted parameter that is concatenated into a SQL statement without sanitisation or escaping, letting them infer and read arbitrary data from the site database. On versions before 2.0.18 a Subscriber-level account is enough, which is significant on sites that permit open user registration, while versions 2.0.18 through 2.0.20 require a Contributor-level account or higher because 2.0.18 removed the subscriber-accessible code path. Publicly available exploit code exists, but the assessed CVSS is 6.3 with AC:H due to the slow, inference-based blind technique, EPSS is only 0.16 percent (4th percentile), SSVC records no observed exploitation, there is no CISA KEV listing, and a vendor patch (2.0.21) is available, so this is a moderate, authentication-gated risk rather than an emergency.
Unauthenticated SQL injection in the WordPress plugin Unlimited Elements for Elementor (versions 1.5.139 through before 2.0.21) allows remote attackers to read non-public content from the site database by supplying a crafted search value that the plugin mishandles when rewriting an already prepared SQL statement. Exploitation is conditional: a related widget option must be set away from its default value for the vulnerable code path to be reachable, which is why the assessed vector carries AC:H despite PR:N and UI:N, and why impact is limited to confidentiality (C:H) with no integrity or availability effect. Publicly available exploit code exists, but EPSS is low at 0.18% (7th percentile) and there is no KEV listing, so this is a real but conditional, moderate-priority issue rather than a top-tier emergency.
Authenticated path traversal in the Unlimited Elements for Elementor WordPress plugin before 2.0.21 lets a privileged user (Administrator by default, or Editor when a specific non-default plugin setting is enabled) plant arbitrary files - including executable PHP - outside the intended upload directory, which can escalate to remote code execution. Exploitation requires two conditions to hold simultaneously: the attacker must already hold an account with access to the plugin's asset-management feature, and the target server must not have the PHP zip extension installed, since only the unsanitized fallback extraction path is vulnerable. Publicly available exploit code exists (tracked via WPScan), but EPSS is only 0.22% (11th percentile) and there is no CISA KEV confirmation of active exploitation, so this is a genuine but constrained risk rather than an urgent widespread threat; a vendor patch is available in version 2.0.21.
Authenticated WordPress users holding a role as low as Subscriber can cause arbitrary shortcodes to be executed on sites running Unlimited Elements for Elementor before 2.0.21, because the plugin's widget-rendering path never verifies that the requester is permitted to invoke it. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N) and our independent assessment keep this at moderate severity: it is an authorization bypass gated behind a low-privileged account, not an unauthenticated code-execution emergency, even though publicly available exploit code exists (WPScan). Exposure is greatest on builds below 2.0.18, where a Subscriber account - trivially obtainable on any site with open registration - is sufficient; from 2.0.18 through 2.0.20 the minimum role rises to Contributor or above. There is no CISA KEV entry, so confirmed active exploitation in the wild has not been established.
Reflected cross-site scripting in the Unlimited Elements For Elementor WordPress plugin (versions ≤2.0.16) allows unauthenticated remote attackers to inject arbitrary JavaScript into pages viewed by victims who follow a crafted link. The vulnerable `show_preview` AJAX action is registered without authentication, and while it is gated by a WordPress nonce, that nonce is trivially retrievable by loading any publicly accessible page on the target site, rendering the protection ineffective. No public exploit has been identified at time of analysis, though the low complexity of exploitation makes this straightforward to weaponize in phishing or drive-by attack chains.
Reflected XSS in the Unlimited Elements For Elementor WordPress plugin (all versions through 2.0.17) allows unauthenticated remote attackers to inject and execute arbitrary JavaScript in a victim's browser by delivering a crafted URL containing a malicious payload in the `formData[id]` parameter. The plugin registers a front-end AJAX handler on the public WordPress `wp` action with no nonce, capability, or referer check; the attacker-controlled parameter value is interpolated verbatim into an exception message and echoed in the HTTP response without output escaping, and when the content-type resolves to text/html the browser parses and executes the injected markup. No public exploit has been identified at the time of analysis, though the unauthenticated network vector and low attack complexity make social-engineering delivery straightforward against WordPress sites running this plugin.
SQL Injection in the Unlimited Elements for Elementor WordPress plugin (versions up to and including 2.0.7) allows authenticated attackers holding at least Contributor-level access to extract sensitive database contents by injecting arbitrary SQL into the 'data[filter_search]' parameter of the get_cat_addons AJAX action. The vulnerability is the product of two chained weaknesses: the plugin's normalizeAjaxInputData() function actively undoes WordPress's built-in magic-quote protection via stripslashes(), and the deprecated wpdb->_escape() method then fails to safely handle the exposed input before it is concatenated directly into a LIKE clause. Reported by Wordfence and tracked as EUVD-2026-30214, no public exploit code has been identified at time of analysis and CISA KEV does not list this CVE, though the confidentiality impact is rated High, enabling full database read access for a successful attacker.
Multiple plugins and/or themes for WordPress are vulnerable to Reflected Cross-Site Scripting via the url parameter in various versions due to insufficient input sanitization and output escaping. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
The Unlimited Elements For Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via several widgets in all versions up to, and including, 1.5.142 due to insufficient input. Rated medium severity (CVSS 6.4), this vulnerability is remotely exploitable, low attack complexity. This Cross-Site Scripting (XSS) vulnerability could allow attackers to inject malicious scripts into web pages viewed by other users.
The Unlimited Elements For Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Transparent Split Hero widget in all versions up to, and including, 1.5.140 due. Rated medium severity (CVSS 6.4), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
The Unlimited Elements For Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via multiple widgets in all versions up to, and including, 1.5.135 due to insufficient input. Rated medium severity (CVSS 6.4), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
The Unlimited Elements For Elementor (Free Widgets, Addons, Templates) plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘Tile Gallery' widget in all versions up to, and. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. This Cross-Site Scripting (XSS) vulnerability could allow attackers to inject malicious scripts into web pages viewed by other users.
Deserialization of Untrusted Data vulnerability in Unlimited Elements Unlimited Elements For Elementor (Free Widgets, Addons, Templates) unlimited-elements-for-elementor allows Command. Rated critical severity (CVSS 9.1), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Unlimited Elements Unlimited Elements For Elementor (Free Widgets, Addons, Templates). Rated high severity (CVSS 7.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
The Unlimited Elements For Elementor (Free Widgets, Addons, Templates) plugin for WordPress is vulnerable to blind SQL Injection via the ‘data[addonID]’ parameter in all versions up to, and. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity.
Missing Authorization vulnerability in Unlimited Elements Unlimited Elements For Elementor (Free Widgets, Addons, Templates) unlimited-elements-for-elementor.5.109. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
The Unlimited Elements For Elementor (Free Widgets, Addons, Templates) plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's text field widget in all versions up to, and. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
The Unlimited Elements For Elementor (Free Widgets, Addons, Templates) plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1.5.89 via the template import. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity.
The Unlimited Elements For Elementor (Free Widgets, Addons, Templates) plugin for WordPress is vulnerable to SQL Injection via the ‘data[post_ids][0]’ parameter in all versions up to, and including,. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity.
The Unlimited Elements For Elementor (Free Widgets, Addons, Templates) plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'google_connect_error' parameter in all versions up. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Cross-Site Scripting (XSS) vulnerability could allow attackers to inject malicious scripts into web pages viewed by other users.
The Unlimited Elements For Elementor (Free Widgets, Addons, Templates) plugin for WordPress is vulnerable to time-based SQL Injection via the ‘id’ parameter in all versions up to, and including,. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
The Unlimited Elements For Elementor (Free Widgets, Addons, Templates) plugin for WordPress is vulnerable to command injection in all versions up to, and including, 1.5.102. Rated high severity (CVSS 7.2), this vulnerability is remotely exploitable, low attack complexity. This OS Command Injection vulnerability could allow attackers to execute arbitrary operating system commands on the host.
Unrestricted Upload of File with Dangerous Type vulnerability in Unlimited Elements Unlimited Elements For Elementor (Free Widgets, Addons, Templates) allows Upload a Web Shell to a Web Server.5.60. Rated critical severity (CVSS 9.9), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
The Unlimited Elements For Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the link field of an installed widget (e.g., 'Button Link') in all versions up to, and. Rated medium severity (CVSS 6.4), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Unlimited Elements Unlimited Elements For Elementor (Free Widgets, Addons, Templates). Rated high severity (CVSS 7.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
Unrestricted Upload of File with Dangerous Type vulnerability in Unlimited Elements Unlimited Elements For Elementor (Free Widgets, Addons, Templates).5.65. Rated critical severity (CVSS 9.9), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
The Unlimited Elements For Elementor (Free Widgets, Addons, Templates) for WordPress is vulnerable to arbitrary file uploads due to missing file type validation of files in the file manager. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
PHP object injection in the Unlimited Elements For Elementor WordPress plugin (versions before 2.0.20) lets authenticated attackers with subscriber-level access inject arbitrary PHP objects through an AJAX action that lacks a capability check and deserializes stored data. Exploitation requires open user registration (or any low-privilege account), and full impact-such as remote code execution or file/database manipulation-depends on a usable PHP POP gadget chain being loaded by WordPress core, Elementor, or another active plugin (hence the AC:H rating). Publicly available exploit code exists, though no confirmed active exploitation (CISA KEV) has been reported; the 2.0.18-2.0.19 releases only partially mitigate by raising the required privilege to editor-level.
Unauthenticated SQL injection in the Unlimited Elements For Elementor WordPress plugin (versions ≤2.0.16) allows remote attackers to extract sensitive data from the WordPress database without any credentials. The flaw exists in getWhereString() where the 'addontype' parameter, when submitted as an array, has its first element injected verbatim as the SQL comparison operator into the WHERE clause; the companion normalizeAjaxInputData() method strips WordPress's built-in magic_quotes protection, eliminating the last layer of defense. No public exploit or KEV listing has been identified at time of analysis, but the unauthenticated network attack path and confirmed Wordfence disclosure make this a credible priority for sites running the affected plugin.
Stored cross-site scripting in the Unlimited Elements For Elementor WordPress plugin (all versions before 2.0.11) lets an unauthenticated attacker plant a malicious Google review on a targeted business's Google listing that, once fetched via the Serp API and rendered unescaped in the Google Reviews widget, executes JavaScript in the browser of every visitor — including logged-in administrators — of any page showing that Place ID's reviews. Publicly available exploit code exists and the vendor has shipped a fix, but there is no public exploit identified as being used in active attacks. The injection is delivered through third-party review content rather than a direct request to the WordPress site, making it a supply-chain-style stored XSS.
Blind SQL injection in the Unlimited Elements For Elementor WordPress plugin (versions up to and including 2.0.8) allows authenticated low-privilege attackers to inject arbitrary SQL into backend database queries. The flaw was reported by Patchstack and carries a CVSS 3.1 score of 8.5 due to scope change and high confidentiality impact, though no public exploit identified at time of analysis and EPSS probability remains low at 0.03%. The scope change (S:C) indicates the injection crosses a trust boundary, amplifying impact beyond the vulnerable component.
Path traversal in Unlimited Elements for Elementor (WordPress plugin ≤2.0.6) enables authenticated attackers with Author-level privileges to read arbitrary files from the web server via crafted URLs in the Repeater JSON/CSV URL parameter. The vulnerability chains multiple sanitization failures in URLtoRelative(), urlToPath(), and cleanPath() functions, allowing traversal sequences like ../../../../etc/passwd to bypass domain-stripping logic and access sensitive files including wp-config.php. CVSS 7.5 indicates high confidentiality impact. EPSS and KEV data not provided; no public exploit confirmed at time of analysis. Wordfence reports the issue with detailed code references to vulnerable functions in versions through 2.0.6.
Blind SQL injection in the Unlimited Elements for Elementor WordPress plugin (all releases before 2.0.21) allows an authenticated attacker to pass a crafted parameter that is concatenated into a SQL statement without sanitisation or escaping, letting them infer and read arbitrary data from the site database. On versions before 2.0.18 a Subscriber-level account is enough, which is significant on sites that permit open user registration, while versions 2.0.18 through 2.0.20 require a Contributor-level account or higher because 2.0.18 removed the subscriber-accessible code path. Publicly available exploit code exists, but the assessed CVSS is 6.3 with AC:H due to the slow, inference-based blind technique, EPSS is only 0.16 percent (4th percentile), SSVC records no observed exploitation, there is no CISA KEV listing, and a vendor patch (2.0.21) is available, so this is a moderate, authentication-gated risk rather than an emergency.
Unauthenticated SQL injection in the WordPress plugin Unlimited Elements for Elementor (versions 1.5.139 through before 2.0.21) allows remote attackers to read non-public content from the site database by supplying a crafted search value that the plugin mishandles when rewriting an already prepared SQL statement. Exploitation is conditional: a related widget option must be set away from its default value for the vulnerable code path to be reachable, which is why the assessed vector carries AC:H despite PR:N and UI:N, and why impact is limited to confidentiality (C:H) with no integrity or availability effect. Publicly available exploit code exists, but EPSS is low at 0.18% (7th percentile) and there is no KEV listing, so this is a real but conditional, moderate-priority issue rather than a top-tier emergency.
Authenticated path traversal in the Unlimited Elements for Elementor WordPress plugin before 2.0.21 lets a privileged user (Administrator by default, or Editor when a specific non-default plugin setting is enabled) plant arbitrary files - including executable PHP - outside the intended upload directory, which can escalate to remote code execution. Exploitation requires two conditions to hold simultaneously: the attacker must already hold an account with access to the plugin's asset-management feature, and the target server must not have the PHP zip extension installed, since only the unsanitized fallback extraction path is vulnerable. Publicly available exploit code exists (tracked via WPScan), but EPSS is only 0.22% (11th percentile) and there is no CISA KEV confirmation of active exploitation, so this is a genuine but constrained risk rather than an urgent widespread threat; a vendor patch is available in version 2.0.21.
Authenticated WordPress users holding a role as low as Subscriber can cause arbitrary shortcodes to be executed on sites running Unlimited Elements for Elementor before 2.0.21, because the plugin's widget-rendering path never verifies that the requester is permitted to invoke it. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N) and our independent assessment keep this at moderate severity: it is an authorization bypass gated behind a low-privileged account, not an unauthenticated code-execution emergency, even though publicly available exploit code exists (WPScan). Exposure is greatest on builds below 2.0.18, where a Subscriber account - trivially obtainable on any site with open registration - is sufficient; from 2.0.18 through 2.0.20 the minimum role rises to Contributor or above. There is no CISA KEV entry, so confirmed active exploitation in the wild has not been established.
Reflected cross-site scripting in the Unlimited Elements For Elementor WordPress plugin (versions ≤2.0.16) allows unauthenticated remote attackers to inject arbitrary JavaScript into pages viewed by victims who follow a crafted link. The vulnerable `show_preview` AJAX action is registered without authentication, and while it is gated by a WordPress nonce, that nonce is trivially retrievable by loading any publicly accessible page on the target site, rendering the protection ineffective. No public exploit has been identified at time of analysis, though the low complexity of exploitation makes this straightforward to weaponize in phishing or drive-by attack chains.
Reflected XSS in the Unlimited Elements For Elementor WordPress plugin (all versions through 2.0.17) allows unauthenticated remote attackers to inject and execute arbitrary JavaScript in a victim's browser by delivering a crafted URL containing a malicious payload in the `formData[id]` parameter. The plugin registers a front-end AJAX handler on the public WordPress `wp` action with no nonce, capability, or referer check; the attacker-controlled parameter value is interpolated verbatim into an exception message and echoed in the HTTP response without output escaping, and when the content-type resolves to text/html the browser parses and executes the injected markup. No public exploit has been identified at the time of analysis, though the unauthenticated network vector and low attack complexity make social-engineering delivery straightforward against WordPress sites running this plugin.
SQL Injection in the Unlimited Elements for Elementor WordPress plugin (versions up to and including 2.0.7) allows authenticated attackers holding at least Contributor-level access to extract sensitive database contents by injecting arbitrary SQL into the 'data[filter_search]' parameter of the get_cat_addons AJAX action. The vulnerability is the product of two chained weaknesses: the plugin's normalizeAjaxInputData() function actively undoes WordPress's built-in magic-quote protection via stripslashes(), and the deprecated wpdb->_escape() method then fails to safely handle the exposed input before it is concatenated directly into a LIKE clause. Reported by Wordfence and tracked as EUVD-2026-30214, no public exploit code has been identified at time of analysis and CISA KEV does not list this CVE, though the confidentiality impact is rated High, enabling full database read access for a successful attacker.
Multiple plugins and/or themes for WordPress are vulnerable to Reflected Cross-Site Scripting via the url parameter in various versions due to insufficient input sanitization and output escaping. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
The Unlimited Elements For Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via several widgets in all versions up to, and including, 1.5.142 due to insufficient input. Rated medium severity (CVSS 6.4), this vulnerability is remotely exploitable, low attack complexity. This Cross-Site Scripting (XSS) vulnerability could allow attackers to inject malicious scripts into web pages viewed by other users.
The Unlimited Elements For Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Transparent Split Hero widget in all versions up to, and including, 1.5.140 due. Rated medium severity (CVSS 6.4), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
The Unlimited Elements For Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via multiple widgets in all versions up to, and including, 1.5.135 due to insufficient input. Rated medium severity (CVSS 6.4), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
The Unlimited Elements For Elementor (Free Widgets, Addons, Templates) plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘Tile Gallery' widget in all versions up to, and. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. This Cross-Site Scripting (XSS) vulnerability could allow attackers to inject malicious scripts into web pages viewed by other users.
Deserialization of Untrusted Data vulnerability in Unlimited Elements Unlimited Elements For Elementor (Free Widgets, Addons, Templates) unlimited-elements-for-elementor allows Command. Rated critical severity (CVSS 9.1), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Unlimited Elements Unlimited Elements For Elementor (Free Widgets, Addons, Templates). Rated high severity (CVSS 7.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
The Unlimited Elements For Elementor (Free Widgets, Addons, Templates) plugin for WordPress is vulnerable to blind SQL Injection via the ‘data[addonID]’ parameter in all versions up to, and. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity.
Missing Authorization vulnerability in Unlimited Elements Unlimited Elements For Elementor (Free Widgets, Addons, Templates) unlimited-elements-for-elementor.5.109. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
The Unlimited Elements For Elementor (Free Widgets, Addons, Templates) plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's text field widget in all versions up to, and. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
The Unlimited Elements For Elementor (Free Widgets, Addons, Templates) plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1.5.89 via the template import. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity.
The Unlimited Elements For Elementor (Free Widgets, Addons, Templates) plugin for WordPress is vulnerable to SQL Injection via the ‘data[post_ids][0]’ parameter in all versions up to, and including,. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity.
The Unlimited Elements For Elementor (Free Widgets, Addons, Templates) plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'google_connect_error' parameter in all versions up. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Cross-Site Scripting (XSS) vulnerability could allow attackers to inject malicious scripts into web pages viewed by other users.
The Unlimited Elements For Elementor (Free Widgets, Addons, Templates) plugin for WordPress is vulnerable to time-based SQL Injection via the ‘id’ parameter in all versions up to, and including,. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
The Unlimited Elements For Elementor (Free Widgets, Addons, Templates) plugin for WordPress is vulnerable to command injection in all versions up to, and including, 1.5.102. Rated high severity (CVSS 7.2), this vulnerability is remotely exploitable, low attack complexity. This OS Command Injection vulnerability could allow attackers to execute arbitrary operating system commands on the host.
Unrestricted Upload of File with Dangerous Type vulnerability in Unlimited Elements Unlimited Elements For Elementor (Free Widgets, Addons, Templates) allows Upload a Web Shell to a Web Server.5.60. Rated critical severity (CVSS 9.9), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
The Unlimited Elements For Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the link field of an installed widget (e.g., 'Button Link') in all versions up to, and. Rated medium severity (CVSS 6.4), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Unlimited Elements Unlimited Elements For Elementor (Free Widgets, Addons, Templates). Rated high severity (CVSS 7.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
Unrestricted Upload of File with Dangerous Type vulnerability in Unlimited Elements Unlimited Elements For Elementor (Free Widgets, Addons, Templates).5.65. Rated critical severity (CVSS 9.9), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
The Unlimited Elements For Elementor (Free Widgets, Addons, Templates) for WordPress is vulnerable to arbitrary file uploads due to missing file type validation of files in the file manager. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.