CVE-2026-85304

The Unlimited Elements For Elementor plugin in versions up to and including 2.0.19 contains a Server Side Request Forgery (SSRF) vulnerability. A user with Contributor privileges can force the server to make requests to arbitrary resources.

The Unlimited Elements For Elementor plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via 'data[name]' Parameter in all versions up to, and including, 2.0.16 due to insufficient input sanitization and output escaping. The show_preview AJAX action is registered for unauthenticated users and is gated only by a nonce, which an unauthenticated attacker can retrieve by loading any publicly accessible page that emits it.

The Unlimited Elements For Elementor plugin for WordPress (versions up to and including 2.0.16) is vulnerable to SQL Injection via the 'addontype' parameter due to insufficient escaping and lack of preparation in the getWhereString() function. An unauthenticated attacker can append additional SQL queries to extract sensitive information from the database.

Unauthenticated Cross Site Scripting (XSS) vulnerability in Unlimited Elements For Elementor (Free Widgets, Addons, Templates) versions up to 2.0.17. Allows an attacker to inject malicious script into a page, which executes in the victim's browser.

The Unlimited Elements For Elementor plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'formData[id]' Parameter in all versions up to and including 2.0.17 due to insufficient input sanitization and output escaping. This allows unauthenticated attackers to inject arbitrary web scripts that execute if they can trick a user into clicking a link. The front-end AJAX handler is registered on the public 'wp' action with no nonce, capability, or referer check, and the raw attacker-controlled id value is interpolated verbatim into an exception message echoed back without escaping.

A vulnerability in the Unlimited Elements For Elementor (Free Widgets, Addons, Templates) plugin up to version 2.0.14 allows a user with Contributor role to download arbitrary files from the server.

Missing Authorization vulnerability in Unlimited Elements For Elementor (Free Widgets, Addons, Templates) allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects versions through 2.0.15.

The Unlimited Elements For Elementor WordPress plugin before version 2.0.11 does not sanitize Google review content from the Serp API before rendering it in the Google Reviews widget. This allows unauthenticated attackers to inject stored XSS via a malicious review on the business's Google listing.

The Unlimited Elements For Elementor (Free Widgets, Addons, Templates) plugin up to version 2.0.12 contains a reflected XSS (Cross-site Scripting) vulnerability due to improper input neutralization during web page generation. An attacker can inject malicious JavaScript code into the server response, which will be executed in the victim's browser.

The Unlimited Elements For Elementor plugin up to version 2.0.8 is vulnerable to blind SQL Injection. Attackers can inject SQL queries through unsanitized parameters, allowing unauthorized database access.