Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
1 selected

3 records

Release: Unlimited Elements for Elementor 2.0.21 Clear all filters
TI-2026-67440 CVE-2026-92923 · GHSA-fwfj-g2x9-rghp

Unlimited Elements For Elementor 1.5.142 - 2.0.20 - Subscriber+ SQLi via get_addon_output_data

Priority LOW 27

The Unlimited Elements for Elementor WordPress plugin before 2.0.21 does not sanitise and escape a parameter before using it in a SQL statement, allowing users with a role as low as subscriber to perform blind SQL inject…

CVSS 3.1MEDIUM 6.3 Network Low privileges No interaction EPSS 0.00177 Published 2026-10-03 Fixed in 2.0.21 CWE-89
TI-2026-67430 CVE-2026-85568 · GHSA-f222-q2vh-g6q6

Unlimited Elements For Elementor 1.5.139 - 2.0.20 - Unauthenticated SQLi via 'ucs' Parameter

Priority LOW 29

The Unlimited Elements for Elementor WordPress plugin before 2.0.21 does not correctly handle a search value before rewriting an already prepared SQL statement, allowing unauthenticated users to perform SQL injection att…

CVSS 3.1MEDIUM 6.8 Network No auth No interaction EPSS 0.00217 Published 2026-10-03 Fixed in 2.0.21 CWE-89
TI-2026-67429 CVE-2026-85015 · GHSA-q6fg-7vp2-c3xp

Unlimited Elements For Elementor < 2.0.21 - Authenticated Arbitrary File Write via Path Traversal

Priority LOW 31

The Unlimited Elements for Elementor WordPress plugin before 2.0.21 does not sanitise file paths inside uploaded archives before extracting them, allowing authenticated users with access to its asset-management feature (…

CVSS 3.1MEDIUM 6.6 Network High privileges No interaction EPSS 0.00409 Published 2026-10-03 Fixed in 2.0.21 CWE-22