Stored Cross-Site Scripting in Unlimited Elements for Elementor Plugin by WordPress

CVE-2026-116558

What is CVE-2026-116558?

The Unlimited Elements for Elementor plugin is susceptible to Stored Cross-Site Scripting due to inadequate input sanitization and output escaping. Attackers can exploit the vulnerable parameter within attacker-controlled RSS feed bodies, allowing the injection of malicious scripts that execute when a user visits an affected page. This issue pertains to all plugin versions up to and including 2.0.26. Exploitation can occur on any site where the administrator has configured the RSS Feed catalog widget to point to a malicious feed URL, as the plugin's existing escaping mechanisms fail to properly handle specific content positions, enabling the injection of raw scripts into pages.

References