CVE-2026-75586
MediumCVSS 6.1Exploitation Probability (EPSS)
Low risk12th percentile - higher than 12% of all known CVEs
Summary
The Unlimited Elements For Elementor plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'formData[id]' Parameter in all versions up to and including 2.0.17 due to insufficient input sanitization and output escaping. This allows unauthenticated attackers to inject arbitrary web scripts that execute if they can trick a user into clicking a link. The front-end AJAX handler is registered on the public 'wp' action with no nonce, capability, or referer check, and the raw attacker-controlled id value is interpolated verbatim into an exception message echoed back without escaping.
Risk Assessment
The risk includes phishing attacks, user session hijacking, and unauthorized actions in the context of the victim's browser.
Recommendation
Update the plugin to the latest patched version. Also consider adding security measures such as nonce and capability checks, and restrict access to public endpoints.
Other vulnerabilities in Unlimited Elements For Elementor
See all- CVE-2026-66608Medium
The Unlimited Elements For Elementor plugin in versions up to and including 2.0.19 contains a Server Side Request Forgery (SSRF) vulnerability. A user with Contributor privileges can force the server to make requests to arbitrary resources.
- CVE-2026-77150Medium
The Unlimited Elements For Elementor plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via 'data[name]' Parameter in all versions up to, and including, 2.0.16 due to insufficient input sanitization and output escaping. The show_preview AJAX action is registered for unauthenticated users and is gated only by a nonce, which an unauthenticated attacker can retrieve by loading any publicly accessible page that emits it.
- CVE-2026-18561High
The Unlimited Elements For Elementor plugin for WordPress (versions up to and including 2.0.16) is vulnerable to SQL Injection via the 'addontype' parameter due to insufficient escaping and lack of preparation in the getWhereString() function. An unauthenticated attacker can append additional SQL queries to extract sensitive information from the database.
- CVE-2026-84820High
Unauthenticated Cross Site Scripting (XSS) vulnerability in Unlimited Elements For Elementor (Free Widgets, Addons, Templates) versions up to 2.0.17. Allows an attacker to inject malicious script into a page, which executes in the victim's browser.
- CVE-2026-85304Medium
Missing Authorization vulnerability in Unlimited Elements Unlimited Elements For Elementor (Free Widgets, Addons, Templates) allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Unlimited Elements For Elementor (Free Widgets, Addons, Templates): from n/a through 2.0.17.
- CVE-2026-28146Medium
A vulnerability in the Unlimited Elements For Elementor (Free Widgets, Addons, Templates) plugin up to version 2.0.14 allows a user with Contributor role to download arbitrary files from the server.
- CVE-2026-28147Medium
Missing Authorization vulnerability in Unlimited Elements For Elementor (Free Widgets, Addons, Templates) allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects versions through 2.0.15.
- CVE-2026-10081High
The Unlimited Elements For Elementor WordPress plugin before version 2.0.11 does not sanitize Google review content from the Serp API before rendering it in the Google Reviews widget. This allows unauthenticated attackers to inject stored XSS via a malicious review on the business's Google listing.
- CVE-2026-57718High
The Unlimited Elements For Elementor (Free Widgets, Addons, Templates) plugin up to version 2.0.12 contains a reflected XSS (Cross-site Scripting) vulnerability due to improper input neutralization during web page generation. An attacker can inject malicious JavaScript code into the server response, which will be executed in the victim's browser.
- CVE-2026-48837High
The Unlimited Elements For Elementor plugin up to version 2.0.8 is vulnerable to blind SQL Injection. Attackers can inject SQL queries through unsanitized parameters, allowing unauthorized database access.
Original NVD description (English source)
The Unlimited Elements For Elementor plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via 'formData[id]' Parameter in all versions up to, and including, 2.0.17 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link. The front-end AJAX handler is registered on the public 'wp' action with no nonce, capability, or referer check, and the raw attacker-controlled id value is interpolated verbatim into an exception message that is echoed back without escaping; when the response is served as text/html rather than application/json, the browser parses the injected markup.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS