Reflected Cross-Site Scripting Vulnerability in Unlimited Elements For Elementor Plugin

CVE-2026-77150

What is CVE-2026-77150?

The Unlimited Elements For Elementor plugin for WordPress suffers from a Reflected Cross-Site Scripting vulnerability through the 'data[name]' parameter across all versions up to and including 2.0.16. This issue arises from inadequate input sanitization and output escaping measures. As a result, unauthenticated attackers can execute arbitrary web scripts by successfully deceiving users into clicking malicious links. The vulnerability is exacerbated by the show_preview AJAX action, which permits unauthenticated access, allowing attackers to exploit the nonce generated on publicly accessible pages.

References