CVE-2026-62007: WordPress Unlimited Elements For Elementor (Free Widgets, Addons, Templates) plugin <= 2.0.26 - Cross Site Scripting (XSS) vulnerability
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Unlimited Elements Unlimited Elements For Elementor (Free Widgets, Addons, Templates) unlimited-elements-for-elementor allows Reflected XSS.This issue affects Unlimited Elements For Elementor (Free Widgets, Addons, Templates): from n/a through 2.0.26.
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
unlimited-elements-for-elementorto a version that resolves this vulnerability.Fixed in 2.0.27
Event History
Frequently Asked Questions
What must an attacker do to exploit this issue?
The vulnerability is reflected XSS and requires user interaction. An attacker would need to cause a user to visit or interact with a crafted request or page containing malicious input.
Does exploitation require an authenticated WordPress account?
No. The listed attack vector is network-based and privileges required are none, indicating the attacker does not need authentication to attempt exploitation.
Which installations are affected?
Unlimited Elements For Elementor (Free Widgets, Addons, Templates) is affected through version 2.0.26. The provided data does not identify a fixed version.
What is the potential impact if exploitation succeeds?
Successful exploitation can affect confidentiality, integrity, and availability, each with low impact. The scope is listed as changed, meaning the impact may extend beyond the vulnerable plugin's security authority.