CVE-2024-0367 Unlimited Elements For Elementor <= 1.5.96 - Authenticated (Contributor+) Stored Cross-Site Scripting via Widget Link

🗓️ 30 Mar 2024 04:31:08Reported by WordfenceType

The Unlimited Elements For Elementor plugin in WordPress is vulnerable to Stored Cross-Site Scripting through the link field of installed widgets

Reporter	Title	Published	Views	Family All 10
CNNVD	WordPress Plugin Unlimited Elements For Elementor 安全漏洞	30 Mar 202400:00	–	cnnvd
CVE	CVE-2024-0367	30 Mar 202404:31	–	cve
EUVD	EUVD-2024-16163	3 Oct 202520:07	–	euvd
NVD	CVE-2024-0367	30 Mar 202405:15	–	nvd
Patchstack	WordPress Unlimited Elements For Elementor (Free Widgets, Addons, Templates) Plugin <= 1.5.96 is vulnerable to Cross Site Scripting (XSS)	1 Apr 202400:00	–	patchstack
Patchstack	WordPress Unlimited Elements For Elementor plugin <= 1.5.96 - Authenticated (Contributor+) Stored Cross-Site Scripting via Widget Link vulnerability	1 Apr 202404:56	–	patchstack
RedhatCVE	CVE-2024-0367	23 May 202507:24	–	redhatcve
Vulnrichment	CVE-2024-0367 Unlimited Elements For Elementor <= 1.5.96 - Authenticated (Contributor+) Stored Cross-Site Scripting via Widget Link	30 Mar 202404:31	–	vulnrichment
Wordfence Blog	Wordfence Intelligence Weekly WordPress Vulnerability Report (March 25, 2024 to March 31, 2024)	4 Apr 202417:35	–	wordfence
WPVulnDB	Unlimited Elements For Elementor < 1.5.97 - Contributor+ Stored XSS	1 Apr 202400:00	–	wpvulndb

[
  {
    "vendor": "unitecms",
    "product": "Unlimited Elements For Elementor",
    "versions": [
      {
        "version": "0",
        "status": "affected",
        "lessThanOrEqual": "1.5.96",
        "versionType": "semver"
      }
    ],
    "defaultStatus": "unaffected"
  }
]

Source	Link
plugins	www.plugins.trac.wordpress.org/changeset
wordfence	www.wordfence.com/threat-intel/vulnerabilities/id/47853750-0bf1-4df3-9c56-c6852543cfad

08 Apr 2026 16:50Current

5.8Medium risk

Vulners AI Score5.8

CVSS 3.16.4

EPSS0.00119

CWE-79