300 matches found
CVE-2026-85017
The Unlimited Elements For Elementor WordPress plugin before 2.0.20 does not perform a capability check on an AJAX action and deserializes attacker-controlled stored data through it, which makes it possible for authenticated attackers with subscriber-level access to inject arbitrary PHP objects. ...
CVE-2026-85017 Unlimited Elements For Elementor < 2.0.20 - Subscriber+ PHP Object Injection
The Unlimited Elements For Elementor WordPress plugin before 2.0.20 does not perform a capability check on an AJAX action and deserializes attacker-controlled stored data through it, which makes it possible for authenticated attackers with subscriber-level access to inject arbitrary PHP objects. ...
EUVD-2026-83669
The Unlimited Elements For Elementor WordPress plugin before 2.0.20 does not perform a capability check on an AJAX action and deserializes attacker-controlled stored data through it, which makes it possible for authenticated attackers with subscriber-level access to inject arbitrary PHP objects. ...
CVE-2026-85017
Unlimited Elements For Elementor is a WordPress plugin that, in versions before 2.0.20 , fails to perform a capability check on an AJAX action and deserializes attacker-controlled stored data through it. This allows authenticated attackers with subscriber-level access to inject arbitrary PHP obje...
Unlimited Elements for Elementor <= 1.5.93 - Cross Site Scripting
Unlimited Elements For Elementor Free Widgets, Addons, Templates versions up to 1.5.93 contain a reflected cross-site scripting caused by improper neutralization of input during web page generation, letting attackers execute malicious scripts in the victim's browser, exploit requires attacker to...
CVE-2026-66608
Contributor Server Side Request Forgery SSRF in Unlimited Elements For Elementor Free Widgets, Addons, Templates = 2.0.19 versions...
EUVD-2026-81502
Contributor Server Side Request Forgery SSRF in Unlimited Elements For Elementor Free Widgets, Addons, Templates = 2.0.19 versions...
CVE-2026-66608
A Server-Side Request Forgery (SSRF) vulnerability was identified in the WordPress plugin Unlimited Elements For Elementor (Free Widgets, Addons, Templates) in versions
WordPress Unlimited Elements For Elementor (Free Widgets, Addons, Templates) plugin <= 2.0.19 - Server Side Request Forgery (SSRF) vulnerability
Server Side Request Forgery SSRF vulnerability discovered by Ayukiab in WordPress Plugin Unlimited Elements For Elementor Free Widgets, Addons, Templates versions = 2.0.19...
WordPress Unlimited Elements For Elementor plugin <= 2.0.16 - Reflected Cross-Site Scripting vulnerability
Reflected Cross-Site Scripting vulnerability discovered by Kuba in WordPress Plugin Unlimited Elements For Elementor Free Widgets, Addons, Templates versions = 2.0.16...
CVE-2026-77150
The Unlimited Elements For Elementor plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via 'dataname' Parameter in all versions up to, and including, 2.0.16 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to injec...
CVE-2026-18561
The Unlimited Elements For Elementor plugin for WordPress is vulnerable to SQL Injection via the 'addontype' parameter in versions up to, and including, 2.0.16. This is due to insufficient escaping on the user-supplied parameter and the lack of sufficient preparation on the existing SQL query in...
CVE-2026-18561
Unlimited Elements For Elementor (Free Widgets, Addons, Templates) for WordPress is vulnerable to unauthenticated SQL injection in versions up to and including 2.0.16 . The flaw resides in the addontype parameter: when supplied as an array, element zero is used verbatim as a SQL comparison operat...
EUVD-2026-75932
The Unlimited Elements For Elementor plugin for WordPress is vulnerable to SQL Injection via the 'addontype' parameter in versions up to, and including, 2.0.16. This is due to insufficient escaping on the user-supplied parameter and the lack of sufficient preparation on the existing SQL query in...
CVE-2026-77150 Unlimited Elements For Elementor <= 2.0.16 - Reflected Cross-Site Scripting
The Unlimited Elements For Elementor plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via 'dataname' Parameter in all versions up to, and including, 2.0.16 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to injec...
EUVD-2026-75955
The Unlimited Elements For Elementor plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via 'dataname' Parameter in all versions up to, and including, 2.0.16 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to injec...
CVE-2026-77150
The Unlimited Elements For Elementor plugin for WordPress (versions up to and including 2.0.16 ) is vulnerable to Reflected Cross-Site Scripting (XSS) via the data[name] parameter in the show_preview AJAX action . The root cause is insufficient input sanitization and output escaping. Notably, the...
WordPress Unlimited Elements For Elementor plugin <= 2.0.16 - Unauthenticated SQL Injection vulnerability
Unauthenticated SQL Injection vulnerability discovered by Yuto Hyakumoto in WordPress Plugin Unlimited Elements For Elementor Free Widgets, Addons, Templates versions = 2.0.16...