Unlimited Elements For Elementor (Free Widgets, Addons, Templates) vulnerabilities

Product

Unlimited Elements For Elementor (Free Widgets, Addons, Templates)

by Unlimited Elements · last CVE Oct 28, 2026

CVEs

On KEV

9.3

Max CVSS

New 30D

Vulnerabilities19 In the news0 Timeline

Severity mix

Critical 1High 9Medium 9Low 0

Severity

All severities19 Critical1 High9 Medium9 Low0

Exploitation

On CISA KEV0 Exploited in the wild0

Watch

Add Unlimited Elements For Elementor (Free Widgets, Addons, Templates) to your stack to get only the CVEs that touch what you run.

CVE	CVSS	EPSS	Published	Summary · affected versions
CVE-2026-103355	9.3	0%	Oct 4	WordPress Unlimited Elements For Elementor (Free Widgets, Addons, Templates) plugin <= 2.0.20 - SQL Injection vulnerability Affected: through 2.0.20
CVE-2026-95534	8.8	0%	Oct 7	WordPress Unlimited Elements For Elementor (Free Widgets, Addons, Templates) plugin <= 2.0.19 - PHP Object Injection vulnerability Affected: through 2.0.19
CVE-2024-6166	8.8	0%	Jul 9	The Unlimited Elements For Elementor (Free Widgets, Addons, Templates) plugin for WordPress is vulnerable to time-based SQL Injection via the ‘addons_order’ parameter in all… Affected: before 1.5.113
CVE-2026-103338	8.5	0%	Oct 1	WordPress Unlimited Elements For Elementor (Free Widgets, Addons, Templates) plugin <= 2.0.20 - SQL Injection vulnerability Affected: through 2.0.20
CVE-2026-115593 New	7.1	–	Oct 28	WordPress Unlimited Elements For Elementor (Free Widgets, Addons, Templates) plugin <= 2.0.24 - Cross Site Scripting (XSS) vulnerability Affected: through 2.0.24
CVE-2026-94662	7.1	0%	Oct 7	WordPress Unlimited Elements For Elementor plugin <= 2.0.19 - Cross Site Scripting (XSS) vulnerability Affected: through 2.0.19
CVE-2026-103344	7.1	0%	Oct 4	WordPress Unlimited Elements For Elementor (Free Widgets, Addons, Templates) plugin <= 2.0.20 - Cross Site Scripting (XSS) vulnerability Affected: through 2.0.20
CVE-2026-103342	7.1	0%	Oct 3	WordPress Unlimited Elements For Elementor (Free Widgets, Addons, Templates) plugin <= 2.0.20 - Cross Site Scripting (XSS) vulnerability Affected: through 2.0.20
CVE-2026-84820	7.1	0%	Sep 8	WordPress Unlimited Elements For Elementor (Free Widgets, Addons, Templates) plugin <= 2.0.17 - Cross Site Scripting (XSS) vulnerability Affected: through 2.0.17
CVE-2026-57718	7.1	0%	Jul 13	WordPress Unlimited Elements For Elementor (Free Widgets, Addons, Templates) plugin <= 2.0.12 - Cross Site Scripting (XSS) vulnerability Affected: through 2.0.12
CVE-2026-105064	6.5	0%	Oct 5	WordPress Unlimited Elements For Elementor (Free Widgets, Addons, Templates) plugin <= 2.0.22 - Broken Access Control vulnerability Affected: through 2.0.22
CVE-2026-28146	6.5	0%	Aug 6	WordPress Unlimited Elements For Elementor (Free Widgets, Addons, Templates) plugin <= 2.0.14 - Arbitrary File Download vulnerability Affected: through 2.0.14
CVE-2026-66608	6.4	0%	Sep 17	WordPress Unlimited Elements For Elementor (Free Widgets, Addons, Templates) plugin <= 2.0.19 - Server Side Request Forgery (SSRF) vulnerability Affected: through 2.0.19
CVE-2026-28147	5.4	0%	Aug 3	WordPress Unlimited Elements For Elementor (Free Widgets, Addons, Templates) plugin <= 2.0.15 - Broken Access Control vulnerability Affected: through 2.0.15
CVE-2024-6170	5.4	0%	Jul 9	The Unlimited Elements For Elementor (Free Widgets, Addons, Templates) plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘email’ parameter in all versions… Affected: before 1.5.113
CVE-2024-6169	5.4	1%	Jul 9	The Unlimited Elements For Elementor (Free Widgets, Addons, Templates) plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘username’ parameter in all… Affected: before 1.5.113
CVE-2026-103341	5.3	0%	Oct 1	WordPress Unlimited Elements For Elementor (Free Widgets, Addons, Templates) plugin <= 2.0.20 - Broken Access Control vulnerability Affected: through 2.0.20
CVE-2026-85304	5.3	0%	Sep 3	WordPress Unlimited Elements For Elementor (Free Widgets, Addons, Templates) plugin <= 2.0.17 - Broken Access Control vulnerability Affected: through 2.0.17
CVE-2024-6171	5.3	0%	Jul 9	The Unlimited Elements For Elementor (Free Widgets, Addons, Templates) plugin for WordPress is vulnerable to IP Address Spoofing in all versions up to, and including, 1.5.112 due… Affected: before 1.5.113