CVE-2026-103341

Reflected XSS vulnerability in Unlimited Elements For Elementor up to version 2.0.20. Improper input neutralization during web page generation.

The Unlimited Elements For Elementor (Free Widgets, Addons, Templates) WordPress plugin contains an SQL Injection (Blind SQL Injection) vulnerability caused by improper neutralization of special elements in SQL commands. The issue affects versions from n/a through 2.0.20.

The Unlimited Elements For Elementor plugin in versions up to and including 2.0.19 contains a Server Side Request Forgery (SSRF) vulnerability. A user with Contributor privileges can force the server to make requests to arbitrary resources.

The Unlimited Elements for Elementor WordPress plugin before 2.0.21 does not correctly handle a search value before rewriting an already prepared SQL statement, allowing unauthenticated users to perform SQL injection attacks and to retrieve non-public content, when a related widget option is set away from its default.

The Unlimited Elements for Elementor WordPress plugin before 2.0.21 does not sanitise file paths inside uploaded archives before extracting them, allowing authenticated users with access to its asset-management feature (Administrators by default, or Editors when a non-default setting is enabled) to write arbitrary files, including executable PHP, outside the intended upload directory on servers where the PHP zip extension is unavailable, leading to Remote Code Execution.

The Unlimited Elements for Elementor WordPress plugin before 2.0.21 does not escape an icon value before concatenating it into an HTML attribute in its shared widget-parameter processor, allowing users with Contributor access (who do not hold unfiltered_html) to store a payload that executes when the page is rendered.

The Unlimited Elements For Elementor plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via 'data[name]' Parameter in all versions up to, and including, 2.0.16 due to insufficient input sanitization and output escaping. The show_preview AJAX action is registered for unauthenticated users and is gated only by a nonce, which an unauthenticated attacker can retrieve by loading any publicly accessible page that emits it.

The Unlimited Elements For Elementor plugin for WordPress (versions up to and including 2.0.16) is vulnerable to SQL Injection via the 'addontype' parameter due to insufficient escaping and lack of preparation in the getWhereString() function. An unauthenticated attacker can append additional SQL queries to extract sensitive information from the database.

Unauthenticated Cross Site Scripting (XSS) vulnerability in Unlimited Elements For Elementor (Free Widgets, Addons, Templates) versions up to 2.0.17. Allows an attacker to inject malicious script into a page, which executes in the victim's browser.

The Unlimited Elements For Elementor plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'formData[id]' Parameter in all versions up to and including 2.0.17 due to insufficient input sanitization and output escaping. This allows unauthenticated attackers to inject arbitrary web scripts that execute if they can trick a user into clicking a link. The front-end AJAX handler is registered on the public 'wp' action with no nonce, capability, or referer check, and the raw attacker-controlled id value is interpolated verbatim into an exception message echoed back without escaping.