CVE-2023-3295
HighCVSS 8.8Exploitation Probability (EPSS)
Elevated risk60th percentile - higher than 60% of all known CVEs
Summary
The Unlimited Elements For Elementor plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the file manager functionality in versions up to and including 1.5.66. This allows authenticated attackers with contributor-level permissions and above to upload arbitrary files on the affected site's server.
Risk Assessment
Attackers can upload malicious files, potentially leading to remote code execution on the server, posing a serious security threat to the organization.
Recommendation
It is recommended to update the plugin to version 1.5.67 or newer to mitigate this vulnerability.
Other vulnerabilities in Unlimited Elements For Elementor
See all- CVE-2026-28146Medium
A vulnerability in the Unlimited Elements For Elementor (Free Widgets, Addons, Templates) plugin up to version 2.0.14 allows a user with Contributor role to download arbitrary files from the server.
- CVE-2026-28147Medium
Missing Authorization vulnerability in Unlimited Elements For Elementor (Free Widgets, Addons, Templates) allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects versions through 2.0.15.
- CVE-2026-10081High
The Unlimited Elements For Elementor WordPress plugin before version 2.0.11 does not sanitize Google review content from the Serp API before rendering it in the Google Reviews widget. This allows unauthenticated attackers to inject stored XSS via a malicious review on the business's Google listing.
- CVE-2026-57718High
The Unlimited Elements For Elementor (Free Widgets, Addons, Templates) plugin up to version 2.0.12 contains a reflected XSS (Cross-site Scripting) vulnerability due to improper input neutralization during web page generation. An attacker can inject malicious JavaScript code into the server response, which will be executed in the victim's browser.
- CVE-2026-48837High
The Unlimited Elements For Elementor plugin up to version 2.0.8 is vulnerable to blind SQL Injection. Attackers can inject SQL queries through unsanitized parameters, allowing unauthorized database access.
Original NVD description (English source)
The Unlimited Elements For Elementor (Free Widgets, Addons, Templates) for WordPress is vulnerable to arbitrary file uploads due to missing file type validation of files in the file manager functionality in versions up to, and including, 1.5.66 . This makes it possible for authenticated attackers, with contributor-level permissions and above, to upload arbitrary files on the affected site's server which may make remote code execution possible. The issue was partially patched in version 1.5.66 and fully patched in 1.5.67. CVE-2023-31231 appears to be a duplicate of this issue.