WordPress security by component
Unlimited Elements For Elementor
Plugin description
Unlimited Elements For Elementor is a WordPress component with 35 published CVE records in this archive. The latest tracked vulnerability was published Jul 20, 2026; the highest CVE/CNA score is 9.9.
Plugin slug:
unlimited-elements-for-elementorLatest vulnerability
CVE-2026-10081: Unlimited Elements For Elementor: Cross-site scripting
Unlimited Elements For Elementor is affected by cross-site scripting. The vulnerable path is reachable without authentication. Injected script can execute in the affected site's origin when the vulnerable output is viewed. The published affected range is < 2.0.11.
| Safe version |
|
||
|---|---|---|---|
| Jul 20, 2026 |
CVE-2026-10081
Unlimited Elements For Elementor: Cross-site scripting
Unlimited Elements For Elementor is affected by cross-site scripting. The vulnerable path is reachable without authentication. Injected script can execute in the affected site's origin when the vulnerable output is viewed. The published affected range is < 2.0.11.
|
2.0.11 |
CVE8.8
NVDPending
|
| Jul 13, 2026 |
CVE-2026-57718
Unlimited Elements For Elementor (Free Widgets, Addons, Templates): Cross-site scripting
Unlimited Elements For Elementor (Free Widgets, Addons, Templates) is affected by cross-site scripting. Exposure depends on how the affected operation is made reachable by the site. Injected script can execute in the affected site's origin when the vulnerable output is viewed. The published affected range is <= 2.0.12.
|
2.0.13 |
CVE7.1
NVDPending
|
| May 25, 2026 |
CVE-2026-48837
Unlimited Elements For Elementor: SQL injection
Unlimited Elements For Elementor is affected by SQL injection. Exposure depends on how the affected operation is made reachable by the site. A successful request can alter database queries and expose or modify WordPress data. The published affected range is n/a through 2.0.8.
|
2.0.9 |
CVE8.5
NVDPending
|
| May 14, 2026 |
CVE-2026-5486
Unlimited Elements For Elementor: SQL injection
Unlimited Elements For Elementor is affected by SQL injection. Exploitation requires at least contributor-level access. A successful request can alter database queries and expose or modify WordPress data. The published affected range is <= 2.0.7.
|
> 2.0.7 |
CVE6.5
NVDPending
|
| Apr 17, 2026 |
CVE-2026-4659
Unlimited Elements For Elementor: Filesystem traversal
Unlimited Elements For Elementor is affected by filesystem traversal. Exploitation requires at least author-level access. A crafted path can escape the intended directory and reach files or directories elsewhere on the server. The published affected range is <= 2.0.6.
|
> 2.0.6 |
CVE7.5
NVDPending
|
| Mar 10, 2026 |
CVE-2026-2724
Unlimited Elements for Elementor: Cross-site scripting
Unlimited Elements for Elementor is affected by cross-site scripting. The vulnerable path is reachable without authentication. Injected script can execute in the affected site's origin when the vulnerable output is viewed.
|
See mitigation notes |
CVE7.2
NVDPending
|
| Feb 03, 2026 |
CVE-2025-14274
Unlimited Elements for Elementor: Cross-site scripting
Unlimited Elements for Elementor is affected by cross-site scripting. Exploitation requires at least contributor-level access. Injected script can execute in the affected site's origin when the vulnerable output is viewed.
|
See mitigation notes |
CVE5.4
NVDPending
|
| Nov 27, 2025 |
CVE-2025-13692
Unlimited Elements For Elementor: Cross-site scripting
Unlimited Elements For Elementor is affected by cross-site scripting. The vulnerable path is reachable without authentication. Injected script can execute in the affected site's origin when the vulnerable output is viewed.
|
See mitigation notes |
CVE7.2
NVDPending
|
| Aug 28, 2025 |
CVE-2025-8603
Unlimited Elements For Elementor: Cross-site scripting
Unlimited Elements For Elementor is affected by cross-site scripting. Exploitation requires at least contributor-level access. Injected script can execute in the affected site's origin when the vulnerable output is viewed.
|
See mitigation notes |
CVE6.4
NVDPending
|
| Apr 03, 2025 |
CVE-2025-1663
Unlimited Elements For Elementor: Cross-site scripting
Unlimited Elements For Elementor is affected by cross-site scripting. Exploitation requires at least contributor-level access. Injected script can execute in the affected site's origin when the vulnerable output is viewed.
|
See mitigation notes |
CVE6.4
NVD5.4
|
| Feb 20, 2025 |
CVE-2024-13155
Unlimited Elements For Elementor: Cross-site scripting
Unlimited Elements For Elementor is affected by cross-site scripting. Exploitation requires at least contributor-level access. Injected script can execute in the affected site's origin when the vulnerable output is viewed.
|
See mitigation notes |
CVE6.4
NVD5.4
|
| Jan 09, 2025 |
CVE-2024-13153
Unlimited Elements For Elementor: Cross-site scripting
Unlimited Elements For Elementor is affected by cross-site scripting. Exploitation requires at least contributor-level access. Injected script can execute in the affected site's origin when the vulnerable output is viewed.
|
See mitigation notes |
CVE6.4
NVD5.4
|
| Dec 12, 2024 |
CVE-2024-10784
Unlimited Elements For Elementor (Free Widgets, Addons, Templates): Cross-site scripting
Unlimited Elements For Elementor (Free Widgets, Addons, Templates) is affected by cross-site scripting. Exploitation requires at least contributor-level access. Injected script can execute in the affected site's origin when the vulnerable output is viewed.
|
See mitigation notes |
CVE6.4
NVD5.4
|
| Oct 16, 2024 |
CVE-2024-49271
Unlimited Elements For Elementor (Free Widgets, Addons, Templates): Code execution
Unlimited Elements For Elementor (Free Widgets, Addons, Templates) is affected by code execution. Exposure depends on how the affected operation is made reachable by the site. Successful exploitation can run attacker-controlled code in the WordPress hosting account.
|
See mitigation notes |
CVE9.1
NVD7.2
|
| Oct 06, 2024 |
CVE-2024-45454
Unlimited Elements For Elementor (Free Widgets, Addons, Templates): Cross-site scripting
Unlimited Elements For Elementor (Free Widgets, Addons, Templates) is affected by cross-site scripting. Exposure depends on how the affected operation is made reachable by the site. Injected script can execute in the affected site's origin when the vulnerable output is viewed.
|
See mitigation notes |
CVE7.1
NVD6.1
|
| Jul 09, 2024 |
CVE-2024-6171
Unlimited Elements For Elementor (Free Widgets, Addons, Templates): A security weakness
Unlimited Elements For Elementor (Free Widgets, Addons, Templates) is affected by a security weakness. The vulnerable path is reachable without authentication. The resulting impact depends on how the affected component exposes the vulnerable operation.
|
See mitigation notes |
CVE5.3
NVDPending
|
| Jul 09, 2024 |
CVE-2024-6170
Unlimited Elements For Elementor (Free Widgets, Addons, Templates): Cross-site scripting
Unlimited Elements For Elementor (Free Widgets, Addons, Templates) is affected by cross-site scripting. Exploitation requires at least contributor-level access. Injected script can execute in the affected site's origin when the vulnerable output is viewed.
|
See mitigation notes |
CVE6.4
NVD5.4
|
| Jul 09, 2024 |
CVE-2024-6169
Unlimited Elements For Elementor (Free Widgets, Addons, Templates): Cross-site scripting
Unlimited Elements For Elementor (Free Widgets, Addons, Templates) is affected by cross-site scripting. Exploitation requires at least contributor-level access. Injected script can execute in the affected site's origin when the vulnerable output is viewed.
|
See mitigation notes |
CVE6.4
NVD5.4
|
| Jul 09, 2024 |
CVE-2024-6166
Unlimited Elements For Elementor (Free Widgets, Addons, Templates): SQL injection
Unlimited Elements For Elementor (Free Widgets, Addons, Templates) is affected by SQL injection. Exploitation requires at least contributor-level access. A successful request can alter database queries and expose or modify WordPress data.
|
See mitigation notes |
CVE8.8
NVDPending
|
| Jun 09, 2024 |
CVE-2023-31080
Unlimited Elements For Elementor (Free Widgets, Addons, Templates): A security weakness
Unlimited Elements For Elementor (Free Widgets, Addons, Templates) is affected by a security weakness. Exposure depends on how the affected operation is made reachable by the site. The resulting impact depends on how the affected component exposes the vulnerable operation.
|
See mitigation notes |
CVE8.3
NVD8.8
|
| Jun 06, 2024 |
CVE-2024-5329
Unlimited Elements For Elementor (Free Widgets, Addons, Templates): SQL injection
Unlimited Elements For Elementor (Free Widgets, Addons, Templates) is affected by SQL injection. Exploitation requires at least contributor-level access. A successful request can alter database queries and expose or modify WordPress data.
|
See mitigation notes |
CVE8.8
NVDPending
|
| Jun 05, 2024 |
CVE-2024-35674
Unlimited Elements For Elementor (Free Widgets, Addons, Templates): A security weakness
Unlimited Elements For Elementor (Free Widgets, Addons, Templates) is affected by a security weakness. Exposure depends on how the affected operation is made reachable by the site. The resulting impact depends on how the affected component exposes the vulnerable operation.
|
See mitigation notes |
CVE4.3
NVD8.8
|
| Jun 04, 2024 |
CVE-2023-33930
Unlimited Elements For Elementor (Free Widgets, Addons, Templates): Dangerous file upload
Unlimited Elements For Elementor (Free Widgets, Addons, Templates) is affected by dangerous file upload. Exposure depends on how the affected operation is made reachable by the site. Successful exploitation can place attacker-controlled executable content on the server and may lead to full site compromise.
|
See mitigation notes |
CVE9.1
NVD7.2
|
| May 30, 2024 |
CVE-2024-3190
Unlimited Elements For Elementor (Free Widgets, Addons, Templates): Cross-site scripting
Unlimited Elements For Elementor (Free Widgets, Addons, Templates) is affected by cross-site scripting. Exploitation requires at least contributor-level access. Injected script can execute in the affected site's origin when the vulnerable output is viewed.
|
See mitigation notes |
CVE5.4
NVD4.6
|
| May 29, 2024 |
CVE-2023-6743
Unlimited Elements For Elementor (Free Widgets, Addons, Templates): Code execution
Unlimited Elements For Elementor (Free Widgets, Addons, Templates) is affected by code execution. Exploitation requires an authenticated WordPress account. Successful exploitation can run attacker-controlled code in the WordPress hosting account.
|
See mitigation notes |
CVE8.8
NVDPending
|
| May 23, 2024 |
CVE-2024-4779
Unlimited Elements For Elementor (Free Widgets, Addons, Templates): SQL injection
Unlimited Elements For Elementor (Free Widgets, Addons, Templates) is affected by SQL injection. Exploitation requires at least contributor-level access. A successful request can alter database queries and expose or modify WordPress data.
|
See mitigation notes |
CVE8.8
NVDPending
|
| May 14, 2024 |
CVE-2024-3547
Unlimited Elements For Elementor (Free Widgets, Addons, Templates): Cross-site scripting
Unlimited Elements For Elementor (Free Widgets, Addons, Templates) is affected by cross-site scripting. The vulnerable path is reachable without authentication. Injected script can execute in the affected site's origin when the vulnerable output is viewed.
|
See mitigation notes |
CVE6.1
NVDPending
|
| May 14, 2024 |
CVE-2024-3055
Unlimited Elements For Elementor (Free Widgets, Addons, Templates): SQL injection
Unlimited Elements For Elementor (Free Widgets, Addons, Templates) is affected by SQL injection. Exploitation requires an authenticated WordPress account. A successful request can alter database queries and expose or modify WordPress data.
|
See mitigation notes |
CVE8.8
NVD8.8
|
| May 14, 2024 |
CVE-2024-2662
Unlimited Elements For Elementor (Free Widgets, Addons, Templates): A security weakness
Unlimited Elements For Elementor (Free Widgets, Addons, Templates) is affected by a security weakness. Exploitation requires at least administrator-level access. The resulting impact depends on how the affected component exposes the vulnerable operation.
|
See mitigation notes |
CVE7.2
NVDPending
|
| Apr 24, 2024 |
CVE-2023-31090
Unlimited Elements For Elementor (Free Widgets, Addons, Templates): Dangerous file upload
Unlimited Elements For Elementor (Free Widgets, Addons, Templates) is affected by dangerous file upload. Exposure depends on how the affected operation is made reachable by the site. Successful exploitation can place attacker-controlled executable content on the server and may lead to full site compromise.
|
See mitigation notes |
CVE9.9
NVD8.8
|
| Mar 30, 2024 |
CVE-2024-0367
Unlimited Elements For Elementor: Cross-site scripting
Unlimited Elements For Elementor is affected by cross-site scripting. Exploitation requires at least contributor-level access. Injected script can execute in the affected site's origin when the vulnerable output is viewed.
|
See mitigation notes |
CVE6.4
NVD5.4
|
| Mar 27, 2024 |
CVE-2024-29792
Unlimited Elements For Elementor (Free Widgets, Addons, Templates): Cross-site scripting
Unlimited Elements For Elementor (Free Widgets, Addons, Templates) is affected by cross-site scripting. Exposure depends on how the affected operation is made reachable by the site. Injected script can execute in the affected site's origin when the vulnerable output is viewed.
|
See mitigation notes |
CVE7.1
NVD6.1
|
| Dec 20, 2023 |
CVE-2023-31231
Unlimited Elements For Elementor (Free Widgets, Addons, Templates): Dangerous file upload
Unlimited Elements For Elementor (Free Widgets, Addons, Templates) is affected by dangerous file upload. Exposure depends on how the affected operation is made reachable by the site. Successful exploitation can place attacker-controlled executable content on the server and may lead to full site compromise.
|
See mitigation notes |
CVE9.9
NVD6.5
|
| Jun 17, 2023 |
CVE-2023-3295
Unlimited Elements For Elementor: Dangerous file upload
Unlimited Elements For Elementor is affected by dangerous file upload. Exploitation requires an authenticated WordPress account. Successful exploitation can place attacker-controlled executable content on the server and may lead to full site compromise.
|
See mitigation notes |
CVE8.8
NVD8.8
|
| Mar 28, 2023 |
CVE-2022-47170
Unlimited Elements For Elementor: Cross-site scripting
Unlimited Elements For Elementor is affected by cross-site scripting. Exposure depends on how the affected operation is made reachable by the site. Injected script can execute in the affected site's origin when the vulnerable output is viewed.
|
See mitigation notes |
CVE5.9
NVD4.8
|