PT-2026-104541

Name of the Vulnerable Software and Affected Versions Responsive Plus – Elementor Templates & Starter Sites versions prior to 3.5.4 Description Stored Cross-Site Scripting occurs due to insufficient input sanitization and output escaping within shortcode attributes. Authenticated attackers with...

PT-2026-104532

Name of the Vulnerable Software and Affected Versions Unlimited Elements for Elementor versions prior to 2.0.21 Description Insufficient sanitization and escaping of a parameter used in a SQL statement allows authenticated users to perform blind SQL injection attacks. This flaw enables the...

CVE-2026-15795: Improper Neutralization of Input During Web Page Generation

The Responsive Plus – Elementor Templates & Starter Sites plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Shortcode Attributes in all versions up to, and including, 3.5.3 due to insufficient input sanitization and output escaping. This makes it possible for authenticated...

CVE-2026-92923: Improper Neutralization of Special Elements used in an SQL Command

The Unlimited Elements for Elementor WordPress plugin before 2.0.21 does not sanitise and escape a parameter before using it in a SQL statement, allowing users with a role as low as subscriber to perform blind SQL injection attacks and read arbitrary data from the database. Version 2.0.18 removed...

CVE-2025-12828: Improper Neutralization of Input During Web Page Generation

The Ultra Addons Lite for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Type Out widget in all versions up to, and including, 1.3.2 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticate...

CVE-2026-85568: Improper Neutralization of Special Elements used in an SQL Command

The Unlimited Elements for Elementor WordPress plugin before 2.0.21 does not correctly handle a search value before rewriting an already prepared SQL statement, allowing unauthenticated users to perform SQL injection attacks and to retrieve non-public content, when a related widget option is set...

WordPress Jeg Kit for Elementor – Powerful Addons for Elementor, Widgets & Templates for WordPress plugin <= 3.2.19 - Unauthenticated Stored Cross-Site Scripting vulnerability

Unauthenticated Stored Cross-Site Scripting vulnerability discovered by Dthangws in WordPress Plugin Jeg Kit for Elementor versions = 3.2.19...

Exploit-CVE-2026-18351

Exploit-CVE-2026-18351 Drag and Drop File Upload for Elementor Forms - Carga de archivos arbitraria no autenticada a RCE.🔥 𝘾𝙤𝙣𝙩𝙖𝙘𝙩: 𝙔𝙤𝙧𝙪 يورو 🔥 https://t.me/ChiefYoru — Channel https://t.me/TeamLeets — Group https://t.me/ChiefYoruPoCs...

WordPress Responsive Starter Templates – Elementor Templates & Starter Sites plugin <= 3.5.3 - Authenticated (Contributor+) Stored Cross-Site Scripting vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting vulnerability discovered by Wordfence PRISM in WordPress Plugin Responsive Plus versions = 3.5.3...

WordPress Ultra Addons Lite for Elementor plugin <= 1.3.2 - Authenticated (Contributor+) Stored Cross-Site Scripting vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting vulnerability discovered by Abu Hurayra HurayraIIT in WordPress Plugin Ultra Addons Lite for Elementor versions = 1.3.2...

CVE-2026-32475

CVE-2026-32475 — Elementor Pro ≤ 4.2.1 Carga Arbitraria de Archivos sin Autenticación → RCE PoC para CVE-2026-32475 CVSS 9.0 Crítico, CWE-434: una carga arbitraria de archivos sin autenticación en el módulo de Formularios de Elementor Pro que conduce a la ejecución remota de código. Corregido en...

WordPress Unlimited Elements For Elementor (Free Widgets, Addons, Templates) plugin <= 2.0.20 - SQL Injection vulnerability

SQL Injection vulnerability discovered by b1ue0cean in WordPress Plugin Unlimited Elements For Elementor Free Widgets, Addons, Templates versions = 2.0.20...

WordPress Unlimited Elements For Elementor (Free Widgets, Addons, Templates) plugin <= 2.0.20 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by nh4tvd in WordPress Plugin Unlimited Elements For Elementor Free Widgets, Addons, Templates versions = 2.0.20...

CVE-2026-92924

The Unlimited Elements for Elementor WordPress plugin before 2.0.21 does not check that a request to render widget output comes from a user allowed to make it, allowing users with a role as low as subscriber to have arbitrary WordPress shortcodes executed on the site. Version 2.0.18 removed the...

WordPress Unlimited Elements for Elementor plugin < 2.0.21 - Subscriber+ Arbitrary Shortcode Execution vulnerability

Subscriber+ Arbitrary Shortcode Execution vulnerability discovered by Jakub Herman in WordPress Plugin Unlimited Elements For Elementor Free Widgets, Addons, Templates versions 2.0.21...

EUVD-2026-91215

The Unlimited Elements for Elementor WordPress plugin before 2.0.21 does not check that a request to render widget output comes from a user allowed to make it, allowing users with a role as low as subscriber to have arbitrary WordPress shortcodes executed on the site. Version 2.0.18 removed the...

CVE-2026-92924

The Unlimited Elements for Elementor WordPress plugin versions prior to 2.0.21 is vulnerable to arbitrary WordPress shortcode execution. The root cause is a lack of authorization checks when rendering widget output, specifically via the get_addon_output_data function. Depending on the version, th...

CVE-2026-92924 Unlimited Elements For Elementor < 2.0.21 - Subscriber+ Arbitrary Shortcode Execution via get_addon_output_data

The Unlimited Elements for Elementor WordPress plugin before 2.0.21 does not check that a request to render widget output comes from a user allowed to make it, allowing users with a role as low as subscriber to have arbitrary WordPress shortcodes executed on the site. Version 2.0.18 removed the...

CVE-2026-85016

The Unlimited Elements for Elementor WordPress plugin before 2.0.21 does not escape an icon value before concatenating it into an HTML attribute in its shared widget-parameter processor, allowing users with Contributor access who do not hold unfilteredhtml to store a payload that executes when th...

CVE-2026-85016 Unlimited Elements For Elementor < 2.0.21 - Contributor+ Stored XSS via Icon Library Parameter

The Unlimited Elements for Elementor WordPress plugin before 2.0.21 does not escape an icon value before concatenating it into an HTML attribute in its shared widget-parameter processor, allowing users with Contributor access who do not hold unfilteredhtml to store a payload that executes when th...