EN ES
Start free
Menu

Unlimited Elements for Elementor: known security problems

59 known security problems reported for this WordPress plugin, with the affected versions, the fix and what to do.

Updated

In short

There are 59 known security problems on this page. Each one has a fixed version. Updating to version 2.0.23 or newer covers every fixed problem listed here.

Based on public reports. Check the plugin’s changelog. Watchfox AI may be wrong.

Get an email when your site is affected: install Watchfox AI (free)

This week

Someone could do things on your site they should not be allowed to (up to and including 2.0.22)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 2.0.22
Fixed in
2.0.23
What to do
If your site has an affected version, update Unlimited Elements for Elementor to version 2.0.23 or newer.
Official ID
CVE-2026-105064
Report title
Unlimited Elements for Elementor <= 2.0.22 - Missing Authorization
First reported
Sources
This week

A stranger could read or change the data in your site’s database (up to and including 2.0.20)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 2.0.20
Fixed in
2.0.21
What to do
If your site has an affected version, update Unlimited Elements for Elementor to version 2.0.21 or newer.
Official ID
CVE-2026-103355
Report title
Unlimited Elements for Elementor <= 2.0.20 - Unauthenticated SQL Injection
First reported
Sources
This week

Someone with a contributor account on your site could in some setups, take over your site

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 2.0.19
Fixed in
2.0.20
What to do
If your site has an affected version, update Unlimited Elements for Elementor to version 2.0.20 or newer.
Official ID
CVE-2026-95534
Report title
Unlimited Elements for Elementor <= 2.0.19 - Authenticated (Contributor+) PHP Object Injection
First reported
Sources
This week

Someone could plant harmful code that runs for your visitors or admins (up to and including 2.0.20)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 2.0.20
Fixed in
2.0.21
What to do
If your site has an affected version, update Unlimited Elements for Elementor to version 2.0.21 or newer.
Official ID
CVE-2026-103344
Report title
Unlimited Elements for Elementor <= 2.0.20 - Reflected Cross-Site Scripting
First reported
Sources
This week

A stranger could plant harmful code that runs for your visitors or admins (up to and including 2.0.19)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 2.0.19
Fixed in
2.0.20
What to do
If your site has an affected version, update Unlimited Elements for Elementor to version 2.0.20 or newer.
Official ID
CVE-2026-94662
Report title
Unlimited Elements for Elementor <= 2.0.19 - Unauthenticated Stored Cross-Site Scripting
First reported
Sources
This week

Someone could plant harmful code that runs for your visitors or admins (up to and including 2.0.20) (2)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 2.0.20
Fixed in
2.0.21
What to do
If your site has an affected version, update Unlimited Elements for Elementor to version 2.0.21 or newer.
Official ID
CVE-2026-103342
Report title
Unlimited Elements for Elementor <= 2.0.20 - Reflected Cross-Site Scripting
First reported
Sources
This week

Someone could do things on your site they should not be allowed to (up to and including 2.0.20)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 2.0.20
Fixed in
2.0.21
What to do
If your site has an affected version, update Unlimited Elements for Elementor to version 2.0.21 or newer.
Official ID
CVE-2026-103341
Report title
Unlimited Elements for Elementor <= 2.0.20 - Missing Authorization
First reported
Sources
This week

Someone with a contributor account on your site could read or change the data in your site’s database (up to and including 2.0.20)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 2.0.20
Fixed in
2.0.21
What to do
If your site has an affected version, update Unlimited Elements for Elementor to version 2.0.21 or newer.
Official ID
CVE-2026-103338
Report title
Unlimited Elements for Elementor <= 2.0.20 - Authenticated (Contributor+) SQL Injection
First reported
Sources
This week

A stranger could read or change the data in your site’s database (from 1.5.139 up to and including 2.0.20)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • From 1.5.139 up to and including 2.0.20
Fixed in
2.0.21
What to do
If your site has an affected version, update Unlimited Elements for Elementor to version 2.0.21 or newer.
Official ID
CVE-2026-85568
Report title
Unlimited Elements For Elementor 1.5.139 - 2.0.20 - Unauthenticated SQL Injection
First reported
Sources
This week

Someone could use it to harm your site (up to and including 2.0.20)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 2.0.20
Fixed in
2.0.21
What to do
If your site has an affected version, update Unlimited Elements for Elementor to version 2.0.21 or newer.
Official ID
CVE-2026-85015
Report title
Unlimited Elements For Elementor <= 2.0.20 - Authenticated (Admin+) Arbitrary File Write
First reported
Sources
This week

Anyone with an account on your site, even a basic one could read or change the data in your site’s database

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • From 1.5.142 up to and including 2.0.20
Fixed in
2.0.21
What to do
If your site has an affected version, update Unlimited Elements for Elementor to version 2.0.21 or newer.
Official ID
CVE-2026-92923
Report title
Unlimited Elements For Elementor 1.5.142 - 2.0.20 - Authenticated (Subscriber+) SQL Injection
First reported
Sources
This week

Anyone with an account on your site, even a basic one could use it to harm your site

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 2.0.20
Fixed in
2.0.21
What to do
If your site has an affected version, update Unlimited Elements for Elementor to version 2.0.21 or newer.
Official ID
CVE-2026-92924
Report title
Unlimited Elements For Elementor <= 2.0.20 - Authenticated (Subscriber+) Arbitrary Shortcode Execution
First reported
Sources
This week

Someone with a contributor account on your site could plant harmful code that runs for your visitors or admins (up to and including 2.0.20)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 2.0.20
Fixed in
2.0.21
What to do
If your site has an affected version, update Unlimited Elements for Elementor to version 2.0.21 or newer.
Official ID
CVE-2026-85016
Report title
Unlimited Elements For Elementor <= 2.0.20 - Authenticated (Contributor+) Stored Cross-Site Scripting
First reported
Sources
This week

Anyone with an account on your site, even a basic one could in some setups, take over your site

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 2.0.19
Fixed in
2.0.20
What to do
If your site has an affected version, update Unlimited Elements for Elementor to version 2.0.20 or newer.
Official ID
CVE-2026-85017
Report title
Unlimited Elements For Elementor <= 2.0.19 - Authenticated (Subscriber+) PHP Object Injection
First reported
Sources
This week

Someone with a contributor account on your site could make your server visit other addresses on their behalf

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 2.0.19
Fixed in
2.0.20
What to do
If your site has an affected version, update Unlimited Elements for Elementor to version 2.0.20 or newer.
Official ID
CVE-2026-66608
Report title
Unlimited Elements For Elementor <= 2.0.19 - Authenticated (Contributor+) Server-Side Request Forgery
First reported
Sources
This week

Someone could plant harmful code that runs for your visitors or admins (up to and including 2.0.16)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 2.0.16
Fixed in
2.0.17
What to do
If your site has an affected version, update Unlimited Elements for Elementor to version 2.0.17 or newer.
Official ID
CVE-2026-77150
Report title
Unlimited Elements For Elementor <= 2.0.16 - Reflected Cross-Site Scripting
First reported
Sources
This week

A stranger could read or change the data in your site’s database (up to and including 2.0.16)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 2.0.16
Fixed in
2.0.17
What to do
If your site has an affected version, update Unlimited Elements for Elementor to version 2.0.17 or newer.
Official ID
CVE-2026-18561
Report title
Unlimited Elements For Elementor <= 2.0.16 - Unauthenticated SQL Injection
First reported
Sources
This week

A stranger could plant harmful code that runs for your visitors or admins (up to and including 2.0.17)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 2.0.17
Fixed in
2.0.18
What to do
If your site has an affected version, update Unlimited Elements for Elementor to version 2.0.18 or newer.
Official ID
CVE-2026-84820
Report title
Unlimited Elements For Elementor <= 2.0.17 - Unauthenticated Stored Cross-Site Scripting
First reported
Sources
This week

Someone could plant harmful code that runs for your visitors or admins (up to and including 2.0.17)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 2.0.17
Fixed in
2.0.18
What to do
If your site has an affected version, update Unlimited Elements for Elementor to version 2.0.18 or newer.
Official ID
CVE-2026-75586
Report title
Unlimited Elements For Elementor <= 2.0.17 - Reflected Cross-Site Scripting via 'formData[id]' Parameter
First reported
Sources
This week

Someone could do things on your site they should not be allowed to (up to and including 2.0.17)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 2.0.17
Fixed in
2.0.18
What to do
If your site has an affected version, update Unlimited Elements for Elementor to version 2.0.18 or newer.
Official ID
CVE-2026-85304
Report title
Unlimited Elements For Elementor <= 2.0.17 - Missing Authorization
First reported
Sources
This week

Someone could do things on your site they should not be allowed to (up to and including 2.0.15)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 2.0.15
Fixed in
2.0.16
What to do
If your site has an affected version, update Unlimited Elements for Elementor to version 2.0.16 or newer.
Official ID
CVE-2026-28147
Report title
Unlimited Elements For Elementor <= 2.0.15 - Missing Authorization
First reported
Sources
This week

Someone with a contributor account on your site could use it to harm your site (up to and including 2.0.14)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 2.0.14
Fixed in
2.0.15
What to do
If your site has an affected version, update Unlimited Elements for Elementor to version 2.0.15 or newer.
Official ID
CVE-2026-28146
Report title
Unlimited Elements For Elementor <= 2.0.14 - Authenticated (Contributor+) Arbitrary File Download
First reported
Sources
This week

A stranger could plant harmful code that runs for your visitors or admins (up to and including 2.0.12)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 2.0.12
Fixed in
2.0.13
What to do
If your site has an affected version, update Unlimited Elements for Elementor to version 2.0.13 or newer.
Official ID
CVE-2026-57718
Report title
Unlimited Elements For Elementor <= 2.0.12 - Unauthenticated Stored Cross-Site Scripting
First reported
Sources
This week

A stranger could plant harmful code that runs for your visitors or admins (up to and including 2.0.10)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 2.0.10
Fixed in
2.0.11
What to do
If your site has an affected version, update Unlimited Elements for Elementor to version 2.0.11 or newer.
Official ID
CVE-2026-10081
Report title
Unlimited Elements for Elementor <= 2.0.10 - Unauthenticated Stored Cross-Site Scripting
First reported
Sources
This week

Someone with a contributor account on your site could read or change the data in your site’s database (up to and including 2.0.8)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 2.0.8
Fixed in
2.0.9
What to do
If your site has an affected version, update Unlimited Elements for Elementor to version 2.0.9 or newer.
Official ID
CVE-2026-48837
Report title
Unlimited Elements For Elementor <= 2.0.8 - Authenticated (Contributor+) SQL Injection
First reported
Sources
This week

Someone with a contributor account on your site could read or change the data in your site’s database (up to and including 2.0.7)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 2.0.7
Fixed in
2.0.8
What to do
If your site has an affected version, update Unlimited Elements for Elementor to version 2.0.8 or newer.
Official ID
CVE-2026-5486
Report title
Unlimited Elements For Elementor <= 2.0.7 - Authenticated (Contributor+) SQL Injection via 'filter_search' Parameter
First reported
Sources
This week

Someone could plant harmful code that runs for your visitors or admins (up to and including 1.5.140)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 1.5.140
Fixed in
1.5.141
What to do
If your site has an affected version, update Unlimited Elements for Elementor to version 1.5.141 or newer.
Official ID
CVE-2024-13362
Report title
Freemius <= 2.10.1 - Reflected DOM-Based Cross-Site Scripting via url Parameter
First reported
Sources
This week

Someone with a contributor account on your site could read or delete private files on your server

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 2.0.6
Fixed in
2.0.7
What to do
If your site has an affected version, update Unlimited Elements for Elementor to version 2.0.7 or newer.
Official ID
CVE-2026-4659
Report title
Unlimited Elements For Elementor <= 2.0.6 - Authenticated (Contributor+) Arbitrary File Read via Path Traversal in Repeater JSON/CSV URL with Path Traversal
First reported
Sources
This week

A stranger could plant harmful code that runs for your visitors or admins (up to and including 2.0.5)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 2.0.5
Fixed in
2.0.6
What to do
If your site has an affected version, update Unlimited Elements for Elementor to version 2.0.6 or newer.
Official ID
CVE-2026-2724
Report title
Unlimited Elements For Elementor <= 2.0.5 - Unauthenticated Stored Cross-Site Scripting via Form Entry Fields
First reported
Sources
This week

Someone with a contributor account on your site could plant harmful code that runs for your visitors or admins (up to and including 2.0.1)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 2.0.1
Fixed in
2.0.2
What to do
If your site has an affected version, update Unlimited Elements for Elementor to version 2.0.2 or newer.
Official ID
CVE-2025-14274
Report title
Unlimited Elements for Elementor <= 2.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Border Hero Widget
First reported
Sources
This week

A stranger could plant harmful code that runs for your visitors or admins (up to and including 2.0)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 2.0
Fixed in
2.0.1
What to do
If your site has an affected version, update Unlimited Elements for Elementor to version 2.0.1 or newer.
Official ID
CVE-2025-13692
Report title
Unlimited Elements For Elementor and Unlimited Elements For Elementor (Premium) <= 2.0 - Unauthenticated Stored Cross-Site Scripting via SVG File Upload
First reported
Sources
This week

Someone with a contributor account on your site could plant harmful code that runs for your visitors or admins (up to and including 1.5.148)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 1.5.148
Fixed in
1.5.149
What to do
If your site has an affected version, update Unlimited Elements for Elementor to version 1.5.149 or newer.
Official ID
CVE-2025-8603
Report title
Unlimited Elements For Elementor <= 1.5.148 - Authenticated (Contributor+) Stored Cross-Site Scripting
First reported
Sources
This week

Someone with a contributor account on your site could plant harmful code that runs for your visitors or admins (up to and including 1.5.142)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 1.5.142
Fixed in
1.5.143
What to do
If your site has an affected version, update Unlimited Elements for Elementor to version 1.5.143 or newer.
Official ID
CVE-2025-1663
Report title
Unlimited Elements For Elementor <= 1.5.142 - Authenticated (Contributor+) Stored Cross-Site Scripting
First reported
Sources
This week

Someone with a contributor account on your site could plant harmful code that runs for your visitors or admins (up to and including 1.5.140)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 1.5.140
Fixed in
1.5.141
What to do
If your site has an affected version, update Unlimited Elements for Elementor to version 1.5.141 or newer.
Official ID
CVE-2024-13155
Report title
Unlimited Elements For Elementor (Free Widgets, Addons, Templates) <= 1.5.140 - Authenticated (Contributor+) Stored Cross-Site Scripting via Transparent Split Hero Widget
First reported
Sources
This week

Someone with a contributor account on your site could plant harmful code that runs for your visitors or admins (up to and including 1.5.135)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 1.5.135
Fixed in
1.5.136
What to do
If your site has an affected version, update Unlimited Elements for Elementor to version 1.5.136 or newer.
Official ID
CVE-2024-13153
Report title
Unlimited Elements For Elementor (Free Widgets, Addons, Templates) <= 1.5.135 - Authenticated (Contributor+) Stored Cross-Site Scripting via Multiple Widgets
First reported
Sources
This week

Someone with a contributor account on your site could plant harmful code that runs for your visitors or admins (up to and including 1.5.126)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 1.5.126
Fixed in
1.5.127
What to do
If your site has an affected version, update Unlimited Elements for Elementor to version 1.5.127 or newer.
Official ID
CVE-2024-10784
Report title
Unlimited Elements For Elementor (Free Widgets, Addons, Templates) <= 1.5.126 - Authenticated (Contributor+) Stored Cross-Site Scripting
First reported
Sources
This week

Someone with an editor account on your site could run their own code on your site and take it over

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 1.5.121
Fixed in
1.5.122
What to do
If your site has an affected version, update Unlimited Elements for Elementor to version 1.5.122 or newer.
Official ID
CVE-2024-49271
Report title
Unlimited Elements For Elementor (Free Widgets, Addons, Templates) <= 1.5.121 - Authenticated (Editor+) Remote Code Execution
First reported
Sources
This week

Someone could plant harmful code that runs for your visitors or admins (up to and including 1.5.121)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 1.5.121
Fixed in
1.5.122
What to do
If your site has an affected version, update Unlimited Elements for Elementor to version 1.5.122 or newer.
Official ID
CVE-2024-45454
Report title
Unlimited Elements For Elementor (Free Widgets, Addons, Templates) <= 1.5.121 - Reflected Cross-Site Scripting
First reported
Sources
This week

Someone could use it to harm your site (up to and including 1.5.112)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 1.5.112
Fixed in
1.5.113
What to do
If your site has an affected version, update Unlimited Elements for Elementor to version 1.5.113 or newer.
Official ID
CVE-2024-6171
Report title
Unlimited Elements For Elementor (Free Widgets, Addons, Templates) <= 1.5.112 - IP Address Spoofing to Antispam Bypass
First reported
Sources
This week

Someone with a contributor account on your site could read or change the data in your site’s database (up to and including 1.5.112)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 1.5.112
Fixed in
1.5.113
What to do
If your site has an affected version, update Unlimited Elements for Elementor to version 1.5.113 or newer.
Official ID
CVE-2024-6166
Report title
Unlimited Elements For Elementor (Free Widgets, Addons, Templates) <= 1.5.112 - Authenticated (Contributor+) Time-Based SQL Injection
First reported
Sources
This week

Someone with a contributor account on your site could plant harmful code that runs for your visitors or admins (up to and including 1.5.112)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 1.5.112
Fixed in
1.5.113
What to do
If your site has an affected version, update Unlimited Elements for Elementor to version 1.5.113 or newer.
Official ID
CVE-2024-6170
Report title
Unlimited Elements For Elementor (Free Widgets, Addons, Templates) <= 1.5.112 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'email'
First reported
Sources
This week

Someone with a contributor account on your site could plant harmful code that runs for your visitors or admins (up to and including 1.5.112) (2)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 1.5.112
Fixed in
1.5.113
What to do
If your site has an affected version, update Unlimited Elements for Elementor to version 1.5.113 or newer.
Official ID
CVE-2024-6169
Report title
Unlimited Elements For Elementor (Free Widgets, Addons, Templates) <= 1.5.112 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'username'
First reported
Sources
This week

Someone with a contributor account on your site could read or change the data in your site’s database (up to and including 1.5.109)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 1.5.109
Fixed in
1.5.110
What to do
If your site has an affected version, update Unlimited Elements for Elementor to version 1.5.110 or newer.
Official ID
CVE-2024-5329
Report title
Unlimited Elements For Elementor (Free Widgets, Addons, Templates) <= 1.5.109 - Authenticated (Contributor+) Blind SQL Injection via data[addonID] Parameter
First reported
Sources
This week

Someone with a contributor account on your site could use it to harm your site (up to and including 1.5.109)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 1.5.109
Fixed in
1.5.110
What to do
If your site has an affected version, update Unlimited Elements for Elementor to version 1.5.110 or newer.
Official ID
CVE-2024-35674
Report title
Unlimited Elements For Elementor (Free Widgets, Addons, Templates) <= 1.5.109 - Authenticated (Contributor+) Information Exposure
First reported
Sources
This week

Someone with a contributor account on your site could plant harmful code that runs for your visitors or admins (up to and including 1.5.107)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 1.5.107
Fixed in
1.5.108
What to do
If your site has an affected version, update Unlimited Elements for Elementor to version 1.5.108 or newer.
Official ID
CVE-2024-3190
Report title
Unlimited Elements For Elementor (Free Widgets, Addons, Templates) <= 1.5.107 - Authenticated (Contributor+) Stored Cross-Site Scripting via Text Field
First reported
Sources
This week

Someone with a contributor account on your site could run their own code on your site and take it over (up to and including 1.5.89)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 1.5.89
Fixed in
1.5.91
What to do
If your site has an affected version, update Unlimited Elements for Elementor to version 1.5.91 or newer.
Official ID
CVE-2023-6743
Report title
Unlimited Elements for Elementor <= 1.5.89 - Authenticated(Contributor+) Remote Code Execution via template import
First reported
Sources
This week

Someone with a contributor account on your site could read or change the data in your site’s database (up to and including 1.5.107)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 1.5.107
Fixed in
1.5.108
What to do
If your site has an affected version, update Unlimited Elements for Elementor to version 1.5.108 or newer.
Official ID
CVE-2024-4779
Report title
Unlimited Elements for Elementor <= 1.5.107 - Authenticated (Contributor+) SQL Injection via data[post_ids][0]
First reported
Sources
This week

Someone with a contributor account on your site could read or change the data in your site’s database (up to and including 1.5.102)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 1.5.102
Fixed in
1.5.105
What to do
If your site has an affected version, update Unlimited Elements for Elementor to version 1.5.105 or newer.
Official ID
CVE-2024-3055
Report title
Unlimited Elements For Elementor (Free Widgets, Addons, Templates) <= 1.5.102 - Authenticated (Contributor+) SQL Injection
First reported
Sources
This week

Someone could use it to harm your site (up to and including 1.5.102)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 1.5.102
Fixed in
1.5.103
What to do
If your site has an affected version, update Unlimited Elements for Elementor to version 1.5.103 or newer.
Official ID
CVE-2024-2662
Report title
Unlimited Elements For Elementor (Free Widgets, Addons, Templates) <= 1.5.102 - Authenticated (Admin+) Command Injection
First reported
Sources
This week

Someone could plant harmful code that runs for your visitors or admins (up to and including 1.5.102)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 1.5.102
Fixed in
1.5.103
What to do
If your site has an affected version, update Unlimited Elements for Elementor to version 1.5.103 or newer.
Official ID
CVE-2024-3547
Report title
Unlimited Elements For Elementor (Free Widgets, Addons, Templates) <= 1.5.102 - Reflected Cross-Site Scripting
First reported
Sources
This week

Someone with a contributor account on your site could plant harmful code that runs for your visitors or admins (up to and including 1.5.96)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 1.5.96
Fixed in
1.5.97
What to do
If your site has an affected version, update Unlimited Elements for Elementor to version 1.5.97 or newer.
Official ID
CVE-2024-0367
Report title
Unlimited Elements For Elementor <= 1.5.96 - Authenticated (Contributor+) Stored Cross-Site Scripting via Widget Link
First reported
Sources
This week

Someone could plant harmful code that runs for your visitors or admins (up to and including 1.5.93)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 1.5.93
Fixed in
1.5.94
What to do
If your site has an affected version, update Unlimited Elements for Elementor to version 1.5.94 or newer.
Official ID
CVE-2024-29792
Report title
Unlimited Elements For Elementor (Free Widgets, Addons, Templates) <= 1.5.93 - Reflected Cross-Site Scripting
First reported
Sources
This week

Someone could plant harmful code that runs for your visitors or admins (up to and including 1.5.74)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 1.5.74
Fixed in
1.5.75
What to do
If your site has an affected version, update Unlimited Elements for Elementor to version 1.5.75 or newer.
Official ID
CVE-2023-33999
Report title
Freemius SDK <= 2.5.9 - Reflected Cross-Site Scripting via fs_request_get
First reported
Sources
This week

Someone could do things on your site they should not be allowed to (up to and including 1.5.65)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 1.5.65
Fixed in
1.5.66
What to do
If your site has an affected version, update Unlimited Elements for Elementor to version 1.5.66 or newer.
Official ID
CVE-2023-31080
Report title
Unlimited Elements For Elementor (Free Widgets, Addons, Templates) <= 1.5.65 - Missing Authorization
First reported
Sources
This week

Someone with a contributor account on your site could run their own code on your site and take it over (up to and including 1.5.66)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 1.5.66
Fixed in
1.5.67
What to do
If your site has an affected version, update Unlimited Elements for Elementor to version 1.5.67 or newer.
Official ID
CVE-2023-3295
Report title
Unlimited Elements For Elementor (Free Widgets, Addons, Templates) <= 1.5.66 - Authenticated (Contributor+) Arbitrary File Upload
First reported
Sources
This week

Someone could run their own code on your site and take it over (up to and including 1.5.60)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 1.5.60
Fixed in
1.5.61
What to do
If your site has an affected version, update Unlimited Elements for Elementor to version 1.5.61 or newer.
Official ID
CVE-2023-31090
Report title
Unlimited Elements For Elementor (Free Widgets, Addons, Templates) <= 1.5.60 - Arbitrary File Upload in File Manager
First reported
Sources
This week

Someone could run their own code on your site and take it over (up to and including 1.5.66)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 1.5.66
Fixed in
1.5.67
What to do
If your site has an affected version, update Unlimited Elements for Elementor to version 1.5.67 or newer.
Official ID
CVE-2023-33930
Report title
Unlimited Elements For Elementor (Free Widgets, Addons, Templates) <= 1.5.66 - Zip Extraction to Arbitrary File Upload in File Manager
First reported
Sources
This week

Someone could use it to harm your site (up to and including 1.5.48)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 1.5.48
Fixed in
1.5.49
What to do
If your site has an affected version, update Unlimited Elements for Elementor to version 1.5.49 or newer.
Official ID
CVE-2022-47170
Report title
Unlimited Elements For Elementor (Free Widgets, Addons, Templates) <= 1.5.48 - Authenticated (Admin+) Cross Site Scripting (XSS)
First reported
Sources
This week

Someone could do things on your site they should not be allowed to (before 1.5.3)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Before 1.5.3
Fixed in
1.5.3
What to do
If your site has an affected version, update Unlimited Elements for Elementor to version 1.5.3 or newer.
Official ID
CVE-2022-4974
Report title
Freemius SDK <= 2.4.2 - Missing Authorization Checks
First reported
Sources

Where this comes from

We collect these reports from public security sources and rewrite them in plain words. Each problem shows its sources and the date we first saw it. This page never says whether your own site is affected: only a check of your site’s versions can tell.

All plugins and themes

Get an email when your site is affected.

Install Watchfox AI once. It checks your plugins and themes against this list every day, for free.

Install Watchfox AI (free)