VulnCrest
Search
Create account
Report an incident
Radar sectionsPlugins & themes
Check my site

WordPress plugin

Unlimited Elements for Elementor security & vulnerabilities

unlimited-elements-for-elementor— active installsLast vulnerability Nov 7, 2026

Unpatched vulnerability in the latest version

At least one vulnerability affects the latest version and no fix has been released. Deactivate the plugin or restrict access to the affected feature until the vendor ships a patch.

Watch plugin
65Known vulnerabilities
  • Critical2
  • High24
  • Medium39
  • Low0
Vulnerabilities per year
2022: 1 vulnerability1222023: 6 vulnerabilities6232024: 17 vulnerabilities17242025: 5 vulnerabilities5252026: 36 vulnerabilities3626

All Unlimited Elements for Elementor vulnerabilities

Unlimited Elements for Elementor vulnerabilities
SeverityVulnerabilityCVEPublished
Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
≤2.0.26Update to 2.0.28
CVE-2026-121579
High7.2Unauthenticated Stored Cross-Site Scripting via RSS Feed Widget
≤2.0.26Update to 2.0.28
CVE-2026-116558
High7.2Unauthenticated Stored Cross-Site Scripting
≤2.0.26Update to 2.0.27
CVE-2026-62007
Medium4.3Missing Authorization
≤2.0.26Update to 2.0.27
CVE-2026-62023
High7.5Authenticated (Contributor+) Local File Inclusion
≤2.0.26Update to 2.0.27
CVE-2026-62121
Medium6.1Reflected Cross-Site Scripting
≤2.0.24Update to 2.0.25
CVE-2026-115593
Medium4.3Missing Authorization
≤2.0.22Update to 2.0.23
CVE-2026-105064
High7.5Unauthenticated SQL Injection
≤2.0.20Update to 2.0.21
CVE-2026-103355
High7.5Authenticated (Contributor+) PHP Object Injection
≤2.0.19Update to 2.0.20
CVE-2026-95534
Medium6.1Reflected Cross-Site Scripting
≤2.0.20Update to 2.0.21
CVE-2026-103344
High7.2Unauthenticated Stored Cross-Site Scripting
≤2.0.19Update to 2.0.20
CVE-2026-94662
Medium6.1Reflected Cross-Site Scripting
≤2.0.20Update to 2.0.21
CVE-2026-103342
Medium5.3Missing Authorization
≤2.0.20Update to 2.0.21
CVE-2026-103341
Medium6.5Authenticated (Contributor+) SQL Injection
≤2.0.20Update to 2.0.21
CVE-2026-103338
High7.2Authenticated (Admin+) Arbitrary File Write
≤2.0.20Update to 2.0.21
CVE-2026-85015
High7.52.0.20 - Unauthenticated SQL Injection
1.5.139 – 2.0.20Update to 2.0.21
CVE-2026-85568
Medium6.52.0.20 - Authenticated (Subscriber+) SQL Injection
1.5.142 – 2.0.20Update to 2.0.21
CVE-2026-92923
Medium5.4Authenticated (Subscriber+) Arbitrary Shortcode Execution
≤2.0.20Update to 2.0.21
CVE-2026-92924
Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
≤2.0.20Update to 2.0.21
CVE-2026-85016
High7.5Authenticated (Subscriber+) PHP Object Injection
≤2.0.19Update to 2.0.20
CVE-2026-85017
Medium6.4Authenticated (Contributor+) Server-Side Request Forgery
≤2.0.19Update to 2.0.20
CVE-2026-66608
Medium6.1Reflected Cross-Site Scripting
≤2.0.16Update to 2.0.17
CVE-2026-77150
High7.5Unauthenticated SQL Injection
≤2.0.16Update to 2.0.17
CVE-2026-18561
High7.2Unauthenticated Stored Cross-Site Scripting
≤2.0.17Update to 2.0.18
CVE-2026-84820
Medium6.1Reflected Cross-Site Scripting via 'formData[id]' Parameter
≤2.0.17Update to 2.0.18
CVE-2026-75586
Medium5.3Missing Authorization
≤2.0.17Update to 2.0.18
CVE-2026-85304
Medium6.5Authenticated (Contributor+) Arbitrary File Download
≤2.0.14Update to 2.0.15
CVE-2026-28146
Medium4.3Missing Authorization
≤2.0.15Update to 2.0.16
CVE-2026-28147
High7.2Unauthenticated Stored Cross-Site Scripting
≤2.0.12Update to 2.0.13
CVE-2026-57718
High7.2Unauthenticated Stored Cross-Site Scripting
≤2.0.10Update to 2.0.11
CVE-2026-10081
Medium6.5Authenticated (Contributor+) SQL Injection
≤2.0.8Update to 2.0.9
CVE-2026-48837
Medium6.5Authenticated (Contributor+) SQL Injection via 'filter_search' Parameter
≤2.0.7Update to 2.0.8
CVE-2026-5486
Medium6.1Reflected DOM-Based Cross-Site Scripting via url Parameter
≤5.5.8Update to 5.5.9
CVE-2024-13362
High7.5Authenticated (Contributor+) Arbitrary File Read via Path Traversal in Repeater JSON/CSV URL with Path Traversal
≤2.0.6Update to 2.0.7
CVE-2026-4659
High7.2Unauthenticated Stored Cross-Site Scripting via Form Entry Fields
≤2.0.5Update to 2.0.6
CVE-2026-2724
Medium5.4Authenticated (Contributor+) Stored Cross-Site Scripting via Border Hero Widget
≤2.0.1Update to 2.0.2
CVE-2025-14274
High7.2Unauthenticated Stored Cross-Site Scripting via SVG File Upload
≤2.0Update to 2.0.1
CVE-2025-13692
Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
≤1.5.148Update to 1.5.149
CVE-2025-8603
Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
≤1.5.142Update to 1.5.143
CVE-2025-1663
Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via Transparent Split Hero Widget
≤1.5.140Update to 1.5.141
CVE-2024-13155
Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via Multiple Widgets
≤1.5.135Update to 1.5.136
CVE-2024-13153
Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
≤1.5.126Update to 1.5.127
CVE-2024-10784
High7.2Authenticated (Editor+) Remote Code Execution
≤1.5.121Update to 1.5.122
CVE-2024-49271
Medium6.1Reflected Cross-Site Scripting
≤1.5.121Update to 1.5.122
CVE-2024-45454
Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via 'username'
≤1.5.112Update to 1.5.113
CVE-2024-6169
Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via 'email'
≤1.5.112Update to 1.5.113
CVE-2024-6170
High8.8Authenticated (Contributor+) Time-Based SQL Injection
≤1.5.112Update to 1.5.113
CVE-2024-6166
Medium5.3IP Address Spoofing to Antispam Bypass
≤1.5.112Update to 1.5.113
CVE-2024-6171
High8.8Authenticated (Contributor+) Blind SQL Injection via data[addonID] Parameter
≤1.5.109Update to 1.5.110
CVE-2024-5329
Medium4.3Authenticated (Contributor+) Information Exposure
≤1.5.109Update to 1.5.110
CVE-2024-35674
Medium5.4Authenticated (Contributor+) Stored Cross-Site Scripting via Text Field
≤1.5.107Update to 1.5.108
CVE-2024-3190
High8.8Authenticated(Contributor+) Remote Code Execution via template import
≤1.5.89Update to 1.5.91
CVE-2023-6743
High8.8Authenticated (Contributor+) SQL Injection via data[post_ids][0]
≤1.5.107Update to 1.5.108
CVE-2024-4779
High8.8Authenticated (Contributor+) SQL Injection
≤1.5.102Update to 1.5.105
CVE-2024-3055
High7.2Authenticated (Admin+) Command Injection
≤1.5.102Update to 1.5.103
CVE-2024-2662
Medium6.1Reflected Cross-Site Scripting
≤1.5.102Update to 1.5.103
CVE-2024-3547
Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via Widget Link
≤1.5.96Update to 1.5.97
CVE-2024-0367
Medium6.1Reflected Cross-Site Scripting
≤1.5.93Update to 1.5.94
CVE-2024-29792
Medium6.1Reflected Cross-Site Scripting via fs_request_get
≤1.9.2No patch available
CVE-2023-33999
Medium6.3Missing Authorization
≤1.5.65Update to 1.5.66
CVE-2023-31080
High8.8Authenticated (Contributor+) Arbitrary File Upload
≤1.5.66Update to 1.5.67
CVE-2023-3295
Critical9.9Arbitrary File Upload in File Manager
≤1.5.60Update to 1.5.61
CVE-2023-31090
Critical9.9 Zip Extraction to Arbitrary File Upload in File Manager
≤1.5.66Update to 1.5.67
CVE-2023-33930
Medium4.4Authenticated (Admin+) Cross Site Scripting (XSS)
≤1.5.48Update to 1.5.49
CVE-2022-47170
Medium6.3Missing Authorization Checks
all versionsNo patch available
CVE-2022-4974

Unlimited Elements for Elementor: common questions

Does Unlimited Elements for Elementor have known vulnerabilities?

Yes. VulnCrest Radar lists 65 known vulnerabilities in Unlimited Elements for Elementor: 2 critical, 24 high, 39 medium. At least one is not fixed in the latest version.

How do I check which version of Unlimited Elements for Elementor I run?

In wp-admin open Plugins → Installed Plugins; the version is shown under the name. Without admin access, our passive Check my site tool can often read it from public files.

What is the most recent Unlimited Elements for Elementor vulnerability?

CVE-2026-121579, published Nov 7, 2026: Unlimited Elements for Elementor <= 2.0.26 - Authenticated (Contributor+) Stored Cross-Site Scripting. Severity: Medium (CVSS 6.4).

Is any Unlimited Elements for Elementor vulnerability listed in CISA KEV?

No. None of the known Unlimited Elements for Elementor vulnerabilities is currently listed in the CISA KEV catalog.

Search VulnCrest Radar

Jump to

Are you sure?