CVE-2026-85017

The Unlimited Elements For Elementor WordPress plugin (before 2.0.20 ) contains a PHP object injection vulnerability caused by a missing capability check on an AJAX action that deserializes attacker-controlled stored data. Authenticated users with subscriber-level access can exploit it to inject ...