Unlimited Elements For Elementor Free Widgets Addons Templates
Monthly
Reflected cross-site scripting in the WordPress plugin Unlimited Elements For Elementor (Free Widgets, Addons, Templates) through version 2.0.24 lets remote attackers supply crafted input that the plugin reflects into a generated page without proper neutralization, so that script supplied by the attacker executes in the browser of a victim who follows a crafted request or URL. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) shows no authentication is needed but successful exploitation depends on the victim interacting with the crafted request, making social engineering the practical limiting factor rather than silent remote compromise. No public exploit code and no confirmed active exploitation are recorded in the available sources, and the specific parameter or page that reflects the input is not described in the available sources.
PHP object injection in the WordPress plugin Unlimited Elements For Elementor (Free Widgets, Addons, Templates) through version 2.0.19 lets an authenticated low-privilege user pass attacker-controlled data into an unsafe PHP deserialization path, resulting in high confidentiality, integrity, and availability impact per the vendor-assigned CVSS 3.1 score of 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). Exploitation requires a logged-in WordPress account with at least low privileges on a site running an affected plugin version, and no end-user interaction is needed; realistic exploitation further depends on the presence of a usable POP gadget chain in the plugin, Elementor, or WordPress core, which is not confirmed by the available data. No public exploit code and no confirmed active exploitation were identified at time of analysis, so exposure is driven primarily by sites that permit self-registration or retain low-privilege accounts they do not tightly control.
Stored cross-site scripting (CWE-79) in the Unlimited Elements For Elementor (Free Widgets, Addons, Templates) WordPress plugin, affecting all versions through 2.0.19, allows an attacker to persist malicious JavaScript that executes in the browser of any user - including administrators - who later views the affected page, widget, or template. The vendor advisory rates this 7.1 (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L), but our independent assessment applies PR:L: realistic exploitation requires an authenticated account with content-editing capability (contributor/author or higher) to submit and store the payload, and the UI:R condition means a separate victim must load the poisoned page before the script fires - so this is not a zero-interaction, unauthenticated attack against default configurations. No public exploit code and no confirmed active exploitation (CISA KEV) were identified at time of analysis, and no EPSS score was supplied.
Blind SQL injection in the Unlimited Elements For Elementor plugin (versions up to 2.0.20) allows remote attackers to extract sensitive information from the WordPress database by inferring query results. The CVSS vector indicates unauthenticated exploitation (PR:N) with no user interaction, but the specific vulnerable endpoint and whether authentication is truly not required remain unconfirmed. No public exploit code has been identified, and the issue is not known to be actively exploited.
Reflected cross-site scripting in the Unlimited Elements For Elementor (Free Widgets, Addons, Templates) WordPress plugin, affecting all versions from the initial release through 2.0.20, allows a remote unauthenticated attacker to run arbitrary script in a victim's browser by tricking that victim into opening a crafted URL containing a malicious payload (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L, PR:N so no attacker authentication, UI:R so victim interaction is mandatory). Patchstack scores this 7.1; our independent assessment concurs on the reflected, interaction-dependent nature of the flaw but rates availability impact as none rather than low. There is no CISA KEV entry and no public exploit code identified at time of analysis, and no EPSS score was supplied; the practical risk is highest when the induced victim is an authenticated WordPress administrator, because the injected script then executes inside an authenticated session.
Reflected cross-site scripting in the Unlimited Elements for Elementor WordPress plugin up to version 2.0.20 allows unauthenticated remote attackers to execute arbitrary scripts in the browser of a victim who clicks a specially crafted link, potentially leading to session hijacking, credential theft, or unauthorized actions performed as the victim. Exploitation requires user interaction and is limited to per-victim social engineering because the payload is not stored; no public exploit code or active exploitation has been identified at time of analysis. The plugin must be installed and active on a WordPress site for the vulnerability to be exploitable.
Blind SQL injection in the WordPress plugin Unlimited Elements for Elementor (Free Widgets, Addons, Templates) through version 2.0.20 allows an authenticated low-privilege user to read arbitrary data from the site's database by injecting SQL through an unsanitized plugin parameter. Exploitation is network-remote and requires no user interaction, though it does require an account with at least contributor/subscriber-tier privileges (PR:L); because the injection is blind, data extraction is iterative and slower than a direct UNION-based attack but remains reliably automatable. No public exploit code and no confirmed active exploitation were identified at time of analysis, so the practical risk is concentrated on membership, e-commerce, and multi-author WordPress sites that hand out low-privilege accounts to untrusted users.
Cross-site scripting in Unlimited Elements For Elementor (Free Widgets, Addons, Templates) versions up to and including 2.0.17 allows unauthenticated attackers to inject malicious scripts that execute in the browser context of site visitors or privileged WordPress users. The CVSS 7.1 rating reflects a scope change (S:C), meaning the injected payload escapes the plugin's own origin and can compromise administrator browser sessions. No public exploit code or active exploitation has been identified at time of analysis.
Reflected cross-site scripting in the Unlimited Elements For Elementor (Free Widgets, Addons, Templates) WordPress plugin affects all versions up to and including 2.0.12, allowing unauthenticated remote attackers to execute arbitrary JavaScript in a victim's browser session when the victim clicks a crafted link. The CVSS 3.1 score of 7.1 reflects a scope change (S:C) where injected script escapes into the victim's browser context, yielding limited confidentiality, integrity, and availability impact. No public exploit has been identified at time of analysis and the flaw is not listed in CISA KEV; the issue was reported by Patchstack.
Missing authorization in the Unlimited Elements For Elementor (Free Widgets, Addons, Templates) WordPress plugin affects every release through 2.0.26, letting a logged-in low-privilege user reach data that the plugin's access control is supposed to keep from them. The flaw is CWE-862 broken access control rated CVSS 4.3 (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N), so impact is limited to confidentiality and requires an authenticated account - the CVSS vector's PR:L means a subscriber-level user on a site with open registration is enough, and anonymous visitors cannot trigger it. As of this analysis there is no CISA KEV listing and no public exploit identified at time of analysis; Patchstack is credited with the disclosure and the vendor advisory does not name a fixed version.
PHP local file inclusion in the Unlimited Elements For Elementor plugin (versions through 2.0.26) lets an authenticated low-privileged user on a WordPress site cause the plugin to include a filename they influence, disclosing the contents of local files. The CVSS vector (AV:N/AC:L/PR:L/UI:N, C:H/I:N/A:N) confirms the main barrier is that a valid low-privilege account is needed; there is no integrity or availability impact, only confidentiality loss. This is a moderate-priority issue rather than an emergency - no CISA KEV entry, no public exploit reference, and the trigger details (the specific endpoint or parameter that controls the include path) are not described in the available sources, with no vendor patch version yet identified in the provided data.
Unsafe reflection (CWE-470) in the Unlimited Elements For Elementor (Free Widgets, Addons, Templates) WordPress plugin through version 2.0.22 lets a low-privileged authenticated account steer which class or code the plugin loads, exposing information that account should not be able to read. The assessed CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N, score 6.5) confirms the attacker must hold a valid WordPress login with at least low privileges, that no user interaction is required, and that impact is limited to confidentiality with no integrity or availability effect. There is no public exploit identified at time of analysis and no confirmed actively exploited (CISA KEV) status, so this is a moderate-severity authenticated information-disclosure issue rather than an emergency, though it is worth remediating because the authentication bar is low on multi-author and membership sites.
Unauthenticated remote attackers can exploit missing authorization checks in the Unlimited Elements for Elementor (Free Widgets, Addons, Templates) WordPress plugin, affecting all versions through 2.0.20. Because the vulnerable endpoint performs no proper access-control validation, a request sent without authentication can reach restricted functionality or data, though the assessed impact is limited to low confidentiality loss with no integrity or availability effect, giving a CVSS 3.1 base score of 5.3. There is no indication of confirmed active exploitation (not in CISA KEV) and no public exploit code identified at time of analysis; the primary prerequisite is simply that an affected, active installation of the plugin be reachable over the network.
Server-side request forgery in the WordPress plugin Unlimited Elements For Elementor (Free Widgets, Addons, Templates) through version 2.0.19 allows an authenticated attacker holding at least the Contributor role to make the affected site's web server issue outbound HTTP requests to attacker-chosen destinations, with no user interaction required. The practical barrier is the Contributor authentication requirement (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N, 6.4), which limits realistic exposure to insider abuse, sites that permit open Contributor registration, or a chained credential-compromise scenario rather than anonymous mass exploitation. No public exploit code has been identified and the vulnerability is not confirmed actively exploited (CISA KEV); this should be triaged as a medium-priority, authentication-gated SSRF and not as a top-tier emergency.
Arbitrary file download via path traversal in the Unlimited Elements For Elementor WordPress plugin (versions ≤ 2.0.14) allows authenticated Contributor-level users to retrieve arbitrary files from the server filesystem. Exploitation requires only low-privilege WordPress credentials and no user interaction, with high confidentiality impact - sensitive files such as wp-config.php containing database credentials are directly at risk. No public exploit or active exploitation has been confirmed at time of analysis, but the low attack complexity and broad deployment of Elementor-based WordPress sites elevates the practical urgency of patching.
Broken access control in the Unlimited Elements For Elementor WordPress plugin (versions through 2.0.15) permits authenticated low-privileged users to invoke restricted plugin functions without proper authorization. The flaw, rooted in CWE-862 (Missing Authorization), allows a subscriber- or contributor-level WordPress account to perform actions that should be restricted to higher-privileged roles, resulting in low-impact integrity and availability consequences. No public exploit code has been identified at time of analysis and the vulnerability is not listed in the CISA KEV catalog.
The Unlimited Elements For Elementor (Free Widgets, Addons, Templates) plugin for WordPress is vulnerable to IP Address Spoofing in all versions up to, and including, 1.5.112 due to insufficient IP. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
The Unlimited Elements For Elementor (Free Widgets, Addons, Templates) plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘email’ parameter in all versions up to, and. Rated medium severity (CVSS 6.4), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available.
The Unlimited Elements For Elementor (Free Widgets, Addons, Templates) plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘username’ parameter in all versions up to, and. Rated medium severity (CVSS 6.4), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available.
The Unlimited Elements For Elementor (Free Widgets, Addons, Templates) plugin for WordPress is vulnerable to time-based SQL Injection via the ‘addons_order’ parameter in all versions up to, and. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity.
Reflected cross-site scripting in the WordPress plugin Unlimited Elements For Elementor (Free Widgets, Addons, Templates) through version 2.0.24 lets remote attackers supply crafted input that the plugin reflects into a generated page without proper neutralization, so that script supplied by the attacker executes in the browser of a victim who follows a crafted request or URL. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) shows no authentication is needed but successful exploitation depends on the victim interacting with the crafted request, making social engineering the practical limiting factor rather than silent remote compromise. No public exploit code and no confirmed active exploitation are recorded in the available sources, and the specific parameter or page that reflects the input is not described in the available sources.
PHP object injection in the WordPress plugin Unlimited Elements For Elementor (Free Widgets, Addons, Templates) through version 2.0.19 lets an authenticated low-privilege user pass attacker-controlled data into an unsafe PHP deserialization path, resulting in high confidentiality, integrity, and availability impact per the vendor-assigned CVSS 3.1 score of 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). Exploitation requires a logged-in WordPress account with at least low privileges on a site running an affected plugin version, and no end-user interaction is needed; realistic exploitation further depends on the presence of a usable POP gadget chain in the plugin, Elementor, or WordPress core, which is not confirmed by the available data. No public exploit code and no confirmed active exploitation were identified at time of analysis, so exposure is driven primarily by sites that permit self-registration or retain low-privilege accounts they do not tightly control.
Stored cross-site scripting (CWE-79) in the Unlimited Elements For Elementor (Free Widgets, Addons, Templates) WordPress plugin, affecting all versions through 2.0.19, allows an attacker to persist malicious JavaScript that executes in the browser of any user - including administrators - who later views the affected page, widget, or template. The vendor advisory rates this 7.1 (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L), but our independent assessment applies PR:L: realistic exploitation requires an authenticated account with content-editing capability (contributor/author or higher) to submit and store the payload, and the UI:R condition means a separate victim must load the poisoned page before the script fires - so this is not a zero-interaction, unauthenticated attack against default configurations. No public exploit code and no confirmed active exploitation (CISA KEV) were identified at time of analysis, and no EPSS score was supplied.
Blind SQL injection in the Unlimited Elements For Elementor plugin (versions up to 2.0.20) allows remote attackers to extract sensitive information from the WordPress database by inferring query results. The CVSS vector indicates unauthenticated exploitation (PR:N) with no user interaction, but the specific vulnerable endpoint and whether authentication is truly not required remain unconfirmed. No public exploit code has been identified, and the issue is not known to be actively exploited.
Reflected cross-site scripting in the Unlimited Elements For Elementor (Free Widgets, Addons, Templates) WordPress plugin, affecting all versions from the initial release through 2.0.20, allows a remote unauthenticated attacker to run arbitrary script in a victim's browser by tricking that victim into opening a crafted URL containing a malicious payload (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L, PR:N so no attacker authentication, UI:R so victim interaction is mandatory). Patchstack scores this 7.1; our independent assessment concurs on the reflected, interaction-dependent nature of the flaw but rates availability impact as none rather than low. There is no CISA KEV entry and no public exploit code identified at time of analysis, and no EPSS score was supplied; the practical risk is highest when the induced victim is an authenticated WordPress administrator, because the injected script then executes inside an authenticated session.
Reflected cross-site scripting in the Unlimited Elements for Elementor WordPress plugin up to version 2.0.20 allows unauthenticated remote attackers to execute arbitrary scripts in the browser of a victim who clicks a specially crafted link, potentially leading to session hijacking, credential theft, or unauthorized actions performed as the victim. Exploitation requires user interaction and is limited to per-victim social engineering because the payload is not stored; no public exploit code or active exploitation has been identified at time of analysis. The plugin must be installed and active on a WordPress site for the vulnerability to be exploitable.
Blind SQL injection in the WordPress plugin Unlimited Elements for Elementor (Free Widgets, Addons, Templates) through version 2.0.20 allows an authenticated low-privilege user to read arbitrary data from the site's database by injecting SQL through an unsanitized plugin parameter. Exploitation is network-remote and requires no user interaction, though it does require an account with at least contributor/subscriber-tier privileges (PR:L); because the injection is blind, data extraction is iterative and slower than a direct UNION-based attack but remains reliably automatable. No public exploit code and no confirmed active exploitation were identified at time of analysis, so the practical risk is concentrated on membership, e-commerce, and multi-author WordPress sites that hand out low-privilege accounts to untrusted users.
Cross-site scripting in Unlimited Elements For Elementor (Free Widgets, Addons, Templates) versions up to and including 2.0.17 allows unauthenticated attackers to inject malicious scripts that execute in the browser context of site visitors or privileged WordPress users. The CVSS 7.1 rating reflects a scope change (S:C), meaning the injected payload escapes the plugin's own origin and can compromise administrator browser sessions. No public exploit code or active exploitation has been identified at time of analysis.
Reflected cross-site scripting in the Unlimited Elements For Elementor (Free Widgets, Addons, Templates) WordPress plugin affects all versions up to and including 2.0.12, allowing unauthenticated remote attackers to execute arbitrary JavaScript in a victim's browser session when the victim clicks a crafted link. The CVSS 3.1 score of 7.1 reflects a scope change (S:C) where injected script escapes into the victim's browser context, yielding limited confidentiality, integrity, and availability impact. No public exploit has been identified at time of analysis and the flaw is not listed in CISA KEV; the issue was reported by Patchstack.
Missing authorization in the Unlimited Elements For Elementor (Free Widgets, Addons, Templates) WordPress plugin affects every release through 2.0.26, letting a logged-in low-privilege user reach data that the plugin's access control is supposed to keep from them. The flaw is CWE-862 broken access control rated CVSS 4.3 (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N), so impact is limited to confidentiality and requires an authenticated account - the CVSS vector's PR:L means a subscriber-level user on a site with open registration is enough, and anonymous visitors cannot trigger it. As of this analysis there is no CISA KEV listing and no public exploit identified at time of analysis; Patchstack is credited with the disclosure and the vendor advisory does not name a fixed version.
PHP local file inclusion in the Unlimited Elements For Elementor plugin (versions through 2.0.26) lets an authenticated low-privileged user on a WordPress site cause the plugin to include a filename they influence, disclosing the contents of local files. The CVSS vector (AV:N/AC:L/PR:L/UI:N, C:H/I:N/A:N) confirms the main barrier is that a valid low-privilege account is needed; there is no integrity or availability impact, only confidentiality loss. This is a moderate-priority issue rather than an emergency - no CISA KEV entry, no public exploit reference, and the trigger details (the specific endpoint or parameter that controls the include path) are not described in the available sources, with no vendor patch version yet identified in the provided data.
Unsafe reflection (CWE-470) in the Unlimited Elements For Elementor (Free Widgets, Addons, Templates) WordPress plugin through version 2.0.22 lets a low-privileged authenticated account steer which class or code the plugin loads, exposing information that account should not be able to read. The assessed CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N, score 6.5) confirms the attacker must hold a valid WordPress login with at least low privileges, that no user interaction is required, and that impact is limited to confidentiality with no integrity or availability effect. There is no public exploit identified at time of analysis and no confirmed actively exploited (CISA KEV) status, so this is a moderate-severity authenticated information-disclosure issue rather than an emergency, though it is worth remediating because the authentication bar is low on multi-author and membership sites.
Unauthenticated remote attackers can exploit missing authorization checks in the Unlimited Elements for Elementor (Free Widgets, Addons, Templates) WordPress plugin, affecting all versions through 2.0.20. Because the vulnerable endpoint performs no proper access-control validation, a request sent without authentication can reach restricted functionality or data, though the assessed impact is limited to low confidentiality loss with no integrity or availability effect, giving a CVSS 3.1 base score of 5.3. There is no indication of confirmed active exploitation (not in CISA KEV) and no public exploit code identified at time of analysis; the primary prerequisite is simply that an affected, active installation of the plugin be reachable over the network.
Server-side request forgery in the WordPress plugin Unlimited Elements For Elementor (Free Widgets, Addons, Templates) through version 2.0.19 allows an authenticated attacker holding at least the Contributor role to make the affected site's web server issue outbound HTTP requests to attacker-chosen destinations, with no user interaction required. The practical barrier is the Contributor authentication requirement (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N, 6.4), which limits realistic exposure to insider abuse, sites that permit open Contributor registration, or a chained credential-compromise scenario rather than anonymous mass exploitation. No public exploit code has been identified and the vulnerability is not confirmed actively exploited (CISA KEV); this should be triaged as a medium-priority, authentication-gated SSRF and not as a top-tier emergency.
Arbitrary file download via path traversal in the Unlimited Elements For Elementor WordPress plugin (versions ≤ 2.0.14) allows authenticated Contributor-level users to retrieve arbitrary files from the server filesystem. Exploitation requires only low-privilege WordPress credentials and no user interaction, with high confidentiality impact - sensitive files such as wp-config.php containing database credentials are directly at risk. No public exploit or active exploitation has been confirmed at time of analysis, but the low attack complexity and broad deployment of Elementor-based WordPress sites elevates the practical urgency of patching.
Broken access control in the Unlimited Elements For Elementor WordPress plugin (versions through 2.0.15) permits authenticated low-privileged users to invoke restricted plugin functions without proper authorization. The flaw, rooted in CWE-862 (Missing Authorization), allows a subscriber- or contributor-level WordPress account to perform actions that should be restricted to higher-privileged roles, resulting in low-impact integrity and availability consequences. No public exploit code has been identified at time of analysis and the vulnerability is not listed in the CISA KEV catalog.
The Unlimited Elements For Elementor (Free Widgets, Addons, Templates) plugin for WordPress is vulnerable to IP Address Spoofing in all versions up to, and including, 1.5.112 due to insufficient IP. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
The Unlimited Elements For Elementor (Free Widgets, Addons, Templates) plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘email’ parameter in all versions up to, and. Rated medium severity (CVSS 6.4), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available.
The Unlimited Elements For Elementor (Free Widgets, Addons, Templates) plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘username’ parameter in all versions up to, and. Rated medium severity (CVSS 6.4), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available.
The Unlimited Elements For Elementor (Free Widgets, Addons, Templates) plugin for WordPress is vulnerable to time-based SQL Injection via the ‘addons_order’ parameter in all versions up to, and. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity.