CVE-2026-48837: Unlimited Elements For Elementor

High severity, CVSS 8.5. EPSS: 0.4% chance of exploitation in the next 30 days.

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Unlimited Elements For Elementor allows Blind SQL Injection. This issue affects Unlimited Elements For Elementor: from n/a through 2.0.8.

Affected products

• Unlimited Elements Unlimited Elements For Elementor: up to and including 2.0.8

Published 2026-05-25. Last modified 2026-07-24.