CVE-2026-85304
MediumCVSS 5.3Exploitation Probability (EPSS)
Low risk8th percentile - higher than 8% of all known CVEs
Summary
Missing Authorization vulnerability in Unlimited Elements Unlimited Elements For Elementor (Free Widgets, Addons, Templates) allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Unlimited Elements For Elementor (Free Widgets, Addons, Templates): from n/a through 2.0.17.
Risk Assessment
An attacker can gain unauthorized access to plugin functionality, potentially leading to data breach or content manipulation.
Recommendation
Update the Unlimited Elements For Elementor plugin to the latest version. Review and fix access control configuration.
Other vulnerabilities in Unlimited Elements For Elementor
See all- CVE-2026-103341Medium
Unlimited Elements For Elementor plugin has a missing authorization vulnerability, allowing exploitation of incorrectly configured access control levels. Affects versions up to 2.0.20.
- CVE-2026-103338High
The Unlimited Elements For Elementor (Free Widgets, Addons, Templates) WordPress plugin contains an SQL Injection (Blind SQL Injection) vulnerability caused by improper neutralization of special elements in SQL commands. The issue affects versions from n/a through 2.0.20.
- CVE-2026-66608Medium
The Unlimited Elements For Elementor plugin in versions up to and including 2.0.19 contains a Server Side Request Forgery (SSRF) vulnerability. A user with Contributor privileges can force the server to make requests to arbitrary resources.
- CVE-2026-103355Critical
The Unlimited Elements For Elementor plugin up to version 2.0.20 contains a blind SQL injection vulnerability. An attacker can exploit this flaw to manipulate database queries without knowing the database structure.
- CVE-2026-121579Medium
The Unlimited Elements For Elementor plugin is vulnerable to Stored Cross-Site Scripting due to improper neutralization of input during web page generation. The issue affects versions up to and including 2.0.26.
- CVE-2026-62007High
The Unlimited Elements For Elementor plugin up to 2.0.26 does not properly neutralize input during web page generation, allowing a Reflected XSS attack. The issue affects versions from n/a through 2.0.26.
- CVE-2026-62121Medium
The Unlimited Elements For Elementor plugin through 2.0.26 contains an improper control of filename for include/require statement in PHP (PHP Remote File Inclusion) vulnerability, allowing PHP Local File Inclusion.
- CVE-2026-62023Medium
The Unlimited Elements For Elementor plugin through 2.0.26 contains a missing authorization vulnerability. This allows exploitation of incorrectly configured access control security levels.
- CVE-2026-115593High
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Unlimited Elements Unlimited Elements For Elementor (Free Widgets, Addons, Templates) unlimited-elements-for-elementor allows Reflected XSS. This issue affects Unlimited Elements For Elementor (Free Widgets, Addons, Templates): from n/a through 2.0.24.
- CVE-2026-95534High
The Unlimited Elements For Elementor WordPress plugin through 2.0.19 is vulnerable to deserialization of untrusted data, allowing object injection.
Original NVD description (English source)
Missing Authorization vulnerability in Unlimited Elements Unlimited Elements For Elementor (Free Widgets, Addons, Templates) allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Unlimited Elements For Elementor (Free Widgets, Addons, Templates): from n/a through 2.0.17.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS