CVE-2026-92924: Unknown Unlimited Elements For Elementor

Medium severity, CVSS 5.4. EPSS: 0.2% chance of exploitation in the next 30 days.

The Unlimited Elements for Elementor WordPress plugin before 2.0.21 does not check that a request to render widget output comes from a user allowed to make it, allowing users with a role as low as subscriber to have arbitrary WordPress shortcodes executed on the site. Version 2.0.18 removed the subscriber-level access, so from 2.0.18 onward the issue requires a Contributor role or above.

Affected products

• Unknown Unlimited Elements For Elementor: before 2.0.21 (fixed in 2.0.21)

Published 2026-10-02. Last modified 2026-10-02.