CVE-2026-92924
MediumCVSS 5.4Exploitation Probability (EPSS)
Low risk7th percentile - higher than 7% of all known CVEs
Summary
The Unlimited Elements for Elementor WordPress plugin before 2.0.21 does not check that a request to render widget output comes from a user allowed to make it. This allows users with a role as low as subscriber to have arbitrary WordPress shortcodes executed on the site; from version 2.0.18 onward the issue requires a Contributor role or above.
Risk Assessment
An attacker with low privileges can execute arbitrary shortcodes, potentially leading to data disclosure, privilege escalation, or other unwanted actions on the site.
Recommendation
Update the Unlimited Elements for Elementor plugin to version 2.0.21 or later and verify that widget rendering requires appropriate permissions.
Other vulnerabilities in Unlimited Elements for Elementor WordPress Plugin
See all- CVE-2026-92923Unknown
The Unlimited Elements for Elementor WordPress plugin before 2.0.21 does not sanitise and escape a parameter before using it in a SQL statement. This allows users with a role as low as subscriber to perform blind SQL injection attacks and read arbitrary data from the database. Version 2.0.18 removed the subscriber-level access, so from 2.0.18 onward the issue requires a Contributor role or above.
- CVE-2026-85017High
The Unlimited Elements For Elementor WordPress plugin before 2.0.20 does not perform a capability check on an AJAX action and deserializes attacker-controlled stored data through it, which makes it possible for authenticated attackers with subscriber-level access to inject arbitrary PHP objects. A partial fix in the 2.0.18 to 2.0.19 releases raised the privilege required to reach the vulnerable action to editor-level, and the issue was fully resolved in 2.0.20.
Original NVD description (English source)
The Unlimited Elements for Elementor WordPress plugin before 2.0.21 does not check that a request to render widget output comes from a user allowed to make it, allowing users with a role as low as subscriber to have arbitrary WordPress shortcodes executed on the site. Version 2.0.18 removed the subscriber-level access, so from 2.0.18 onward the issue requires a Contributor role or above.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS