Unknown Unlimited Elements For Elementor vulnerabilities

7 CVEs affecting Unknown Unlimited Elements For Elementor, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2026-92923, published 2026-10-03.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2026-10081, published 2026-07-20. High severity, CVSS 8.8. EPSS: 0.5% chance of exploitation in the next 30 days. The Unlimited Elements For Elementor WordPress plugin before 2.0.11 does not sanitize or escape Google review content fetched from the Serp API before rendering it in the Google Reviews widget…
CVE-2026-85015, published 2026-10-03. Medium severity, CVSS 6.6. EPSS: 0.4% chance of exploitation in the next 30 days. The Unlimited Elements for Elementor WordPress plugin before 2.0.21 does not sanitise file paths inside uploaded archives before extracting them, allowing authenticated users with access to its…
CVE-2026-85017, published 2026-09-20. High severity, CVSS 7.5. EPSS: 0.4% chance of exploitation in the next 30 days. The Unlimited Elements For Elementor WordPress plugin before 2.0.20 does not perform a capability check on an AJAX action and deserializes attacker-controlled stored data through it, which makes it…
CVE-2026-85016, published 2026-10-02. Medium severity, CVSS 6.8. EPSS: 0.2% chance of exploitation in the next 30 days. The Unlimited Elements for Elementor WordPress plugin before 2.0.21 does not escape an icon value before concatenating it into an HTML attribute in its shared widget-parameter processor, allowing…
CVE-2026-85568, published 2026-10-03. Medium severity, CVSS 6.8. EPSS: 0.2% chance of exploitation in the next 30 days. The Unlimited Elements for Elementor WordPress plugin before 2.0.21 does not correctly handle a search value before rewriting an already prepared SQL statement, allowing unauthenticated users to…
CVE-2026-92923, published 2026-10-03. Medium severity, CVSS 6.3. EPSS: 0.2% chance of exploitation in the next 30 days. The Unlimited Elements for Elementor WordPress plugin before 2.0.21 does not sanitise and escape a parameter before using it in a SQL statement, allowing users with a role as low as subscriber to…
CVE-2026-92924, published 2026-10-02. Medium severity, CVSS 5.4. EPSS: 0.2% chance of exploitation in the next 30 days. The Unlimited Elements for Elementor WordPress plugin before 2.0.21 does not check that a request to render widget output comes from a user allowed to make it, allowing users with a role as low as…