CVE-2026-105064

Unlimited Elements For Elementor plugin has a missing authorization vulnerability, allowing exploitation of incorrectly configured access control levels. Affects versions up to 2.0.20.

The Unlimited Elements For Elementor (Free Widgets, Addons, Templates) WordPress plugin contains an SQL Injection (Blind SQL Injection) vulnerability caused by improper neutralization of special elements in SQL commands. The issue affects versions from n/a through 2.0.20.

The Unlimited Elements For Elementor plugin in versions up to and including 2.0.19 contains a Server Side Request Forgery (SSRF) vulnerability. A user with Contributor privileges can force the server to make requests to arbitrary resources.

The Unlimited Elements For Elementor plugin up to version 2.0.20 contains a blind SQL injection vulnerability. An attacker can exploit this flaw to manipulate database queries without knowing the database structure.

The Unlimited Elements For Elementor WordPress plugin through 2.0.19 is vulnerable to deserialization of untrusted data, allowing object injection.

Stored XSS vulnerability in Unlimited Elements For Elementor plugin. Improper input neutralization during web page generation allows persistent injection of malicious script that executes on every page view. Affects versions from n/a through 2.0.19.

The Unlimited Elements For Elementor plugin up to version 2.0.20 contains a reflected XSS vulnerability. An attacker can inject a malicious script that executes in the victim's browser.

Reflected XSS vulnerability in Unlimited Elements For Elementor up to version 2.0.20. Improper input neutralization during web page generation.

The Unlimited Elements for Elementor WordPress plugin before 2.0.21 does not correctly handle a search value before rewriting an already prepared SQL statement, allowing unauthenticated users to perform SQL injection attacks and to retrieve non-public content, when a related widget option is set away from its default.

The Unlimited Elements for Elementor WordPress plugin before 2.0.21 does not sanitise file paths inside uploaded archives before extracting them, allowing authenticated users with access to its asset-management feature (Administrators by default, or Editors when a non-default setting is enabled) to write arbitrary files, including executable PHP, outside the intended upload directory on servers where the PHP zip extension is unavailable, leading to Remote Code Execution.