CVE-2026-84820: WordPress Unlimited Elements For Elementor (Free Widgets, Addons, Templates) plugin <= 2.0.17 - Cross Site Scripting (XSS) vulnerability
Unauthenticated Cross Site Scripting (XSS) in Unlimited Elements For Elementor (Free Widgets, Addons, Templates) <= 2.0.17 versions.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
WordPress Unlimited Elements For Elementor (Free Widgets, Addons, Templates)to a version that resolves this vulnerability.Fixed in 2.0.18
Event History
Frequently Asked Questions
Who can exploit this issue?
The vulnerability is unauthenticated, so an attacker does not need a WordPress account or plugin-specific privileges. Exploitation still requires user interaction, as indicated by the UI:R attack vector.
Which plugin versions are affected?
Versions 2.0.17 and earlier are identified as affected. The provided data does not identify a fixed version.
What impact could successful exploitation have?
The CVSS vector indicates low confidentiality, integrity, and availability impact, with scope changed. As an XSS issue, successful exploitation can cause script execution in a user's browser in the context of the affected site.