CVE-2026-92923: Unknown Unlimited Elements For Elementor

Medium severity, CVSS 6.3. EPSS: 0.2% chance of exploitation in the next 30 days.

The Unlimited Elements for Elementor WordPress plugin before 2.0.21 does not sanitise and escape a parameter before using it in a SQL statement, allowing users with a role as low as subscriber to perform blind SQL injection attacks and read arbitrary data from the database. Version 2.0.18 removed the subscriber-level access, so from 2.0.18 onward the issue requires a Contributor role or above.

Affected products

• Unknown Unlimited Elements For Elementor: from 1.5.142, before 2.0.21 (fixed in 2.0.21)

Published 2026-10-03. Last modified 2026-10-06.