CVE-2026-85016: Unlimited Elements For Elementor < 2.0.21 - Contributor+ Stored XSS via Icon Library Parameter
The Unlimited Elements for Elementor WordPress plugin before 2.0.21 does not escape an icon value before concatenating it into an HTML attribute in its shared widget-parameter processor, allowing users with Contributor access (who do not hold unfilteredhtml) to store a payload that executes when the page is rendered.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
An authenticated WordPress user with Contributor-level access can exploit it. The affected user does not need the unfiltered_html capability.
When does the stored payload execute?
The payload executes when the affected page is rendered. This means users who view or render the page containing the malicious icon value may be exposed.
Which installations are affected?
Unlimited Elements for Elementor versions before 2.0.21 are affected. The issue is in the shared widget-parameter processor when an icon value is concatenated into an HTML attribute.