CVE-2026-94662: WordPress Unlimited Elements For Elementor plugin <= 2.0.19 - Cross Site Scripting (XSS) vulnerability
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Unlimited Elements Unlimited Elements For Elementor (Free Widgets, Addons, Templates) allows Stored XSS.
This issue affects Unlimited Elements For Elementor (Free Widgets, Addons, Templates): from n/a through 2.0.19.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Unlimited Elements For Elementor (Free Widgets, Addons, Templates)to a version that resolves this vulnerability.Fixed in 2.0.20
Event History
Frequently Asked Questions
Does exploitation require an authenticated WordPress account?
No. The CVSS vector indicates no privileges are required (PR:N) and that the issue is remotely reachable over the network (AV:N).
Is user interaction required for exploitation?
Yes. The CVSS vector includes UI:R, indicating that a user must interact with attacker-controlled content for the XSS to execute.
What versions should be treated as affected?
Unlimited Elements For Elementor (Free Widgets, Addons, Templates) is affected through version 2.0.19. The available data does not identify a fixed version.
What is the potential impact if the XSS is exploited?
The CVSS data indicates low impact to confidentiality, integrity, and availability, with scope changed (S:C). The vulnerability is classified as stored XSS.