CVE-2026-115593: WordPress Unlimited Elements For Elementor (Free Widgets, Addons, Templates) plugin <= 2.0.24 - Cross Site Scripting (XSS) vulnerability

Q: Which installations are affected?

The issue affects Unlimited Elements For Elementor (Free Widgets, Addons, Templates) through version 2.0.24. The provided data does not identify a fixed version.

Q: What does an attacker need to exploit this issue?

The CVSS vector indicates network-reachable exploitation with low attack complexity and no privileges required, but user interaction is required. The vulnerability is reflected XSS, so exploitation generally depends on getting a user to interact with attacker-supplied input.

Q: What is the potential impact?

The supplied severity vector rates confidentiality, integrity, and availability impact as low, with scope changed. Successful exploitation could affect a different security authority than the vulnerable component.

Published Oct 28, 2026

Updated

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Unlimited Elements Unlimited Elements For Elementor (Free Widgets, Addons, Templates) unlimited-elements-for-elementor allows Reflected XSS.This issue affects Unlimited Elements For Elementor (Free Widgets, Addons, Templates): from n/a through 2.0.24.

Affected Software

1 affected component

Unlimited Elements Unlimited Elements For Elementor (Free Widgets, Addons, Templates)<=2.0.24

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade unlimited-elements-for-elementor to a version that resolves this vulnerability.
Fixed in 2.0.25

Event History

Oct 28, 2026

CVE Published

via MITRE·01:00 PM

Data Sourced

via MITRE·01:00 PM

RemedyDescriptionSeverityWeakness

Frequently Asked Questions

Which installations are affected?

The issue affects Unlimited Elements For Elementor (Free Widgets, Addons, Templates) through version 2.0.24. The provided data does not identify a fixed version.

What does an attacker need to exploit this issue?

The CVSS vector indicates network-reachable exploitation with low attack complexity and no privileges required, but user interaction is required. The vulnerability is reflected XSS, so exploitation generally depends on getting a user to interact with attacker-supplied input.

What is the potential impact?

The supplied severity vector rates confidentiality, integrity, and availability impact as low, with scope changed. Successful exploitation could affect a different security authority than the vulnerable component.

CVE-2026-115593: WordPress Unlimited Elements For Elementor (Free Widgets, Addons, Templates) plugin <= 2.0.24 - Cross Site Scripting (XSS) vulnerability

Affected Software

Remediation

Event History

Frequently Asked Questions

Which installations are affected?

What does an attacker need to exploit this issue?

What is the potential impact?

Company

Resources

Contact

Frequently Asked Questions

Which installations are affected?

What does an attacker need to exploit this issue?

What is the potential impact?