Cross-site Scripting Vulnerability in Unlimited Elements for Elementor by Unlimited Elements
CVE-2026-121579

6.5MEDIUM

Key Information:

Vendor

WordPress
Status
Unlimited Elements For Elementor (free Widgets, Addons, Templates)
Vendor
CVE Published:
7 November 2026

What is CVE-2026-121579?

The vulnerability presents itself as improper neutralization of input during web page generation, leading to a Stored XSS risk. Attackers could exploit this weakness to inject malicious scripts that could be executed in the browser of a user accessing a page generated by the affected versions of Unlimited Elements for Elementor. This would enable unauthorized actions or information theft, thus compromising the security of affected websites.

Affected Version(s)

Unlimited Elements For Elementor (Free Widgets, Addons, Templates) 0 <= 2.0.26

References

https://patchstack.com/database/wordpress/plugin/unlimite...
vdb-entry

CVSS V3.1

Score:
6.5
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

nh4tvd | Patchstack Bug Bounty Program
.