High severity · published Oct 28, 2026
CVE-2026-115593
WordPress Unlimited Elements For Elementor (Free Widgets, Addons, Templates) plugin <= 2.0.24 - Cross Site Scripting (XSS) vulnerability
New
7.1
CVSS
–
EPSS
No
On KEV
Description
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Unlimited Elements Unlimited Elements For Elementor (Free Widgets, Addons, Templates) unlimited-elements-for-elementor allows Reflected XSS.This issue affects Unlimited Elements For Elementor (Free Widgets, Addons, Templates): from n/a through 2.0.24.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
Required
Confidentiality
Low
Integrity
Low
Availability
Low
Scope
Changed
Exploitation
Is it being used?
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
UE
Unlimited Elements For Elementor (Free Widgets, Addons, Templates) · Unlimited Elements
through 2.0.24 · source: vendor
Affected product
UE
Unlimited Elements For Elementor (Free Widgets, Addons, Templates)
Unlimited Elements
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-115593
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-115593
vdb-entry
https://patchstack.com/database/wordpress/plugin/unlimited-elements-for-elementor/vulnerability/wordpress-unlimited-elements-for-elementor-free-widgets-addons-templates-plugin-2-0-24-cross-site-scripting-xss-vulnerability?_s_id=cve
More from Unlimited Elements For Elementor (Free Widgets, Addons, Templates)
9.3
CVE-2026-103355
WordPress Unlimited Elements For Elementor (Free Widgets, Addons, Templates) plugin <= 2.0.20 - SQL Injection vulnerability
8.8
CVE-2026-95534
WordPress Unlimited Elements For Elementor (Free Widgets, Addons, Templates) plugin <= 2.0.19 - PHP Object Injection vulnerability
8.8
CVE-2024-6166
The Unlimited Elements For Elementor (Free Widgets, Addons, Templates) plugin for WordPress is vulnerable to time-based SQL Injection via the ‘addons_order’ parameter in all…
8.5
CVE-2026-103338
WordPress Unlimited Elements For Elementor (Free Widgets, Addons, Templates) plugin <= 2.0.20 - SQL Injection vulnerability
7.1
CVE-2026-94662
WordPress Unlimited Elements For Elementor plugin <= 2.0.19 - Cross Site Scripting (XSS) vulnerability