Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
9.3

Unlimited Elements for Elementor plugin allows database query attack

CVE-2026-103355 · published 15 days ago
Summary

The free Unlimited Elements for Elementor plugin (versions up to 2.0.20) can be tricked into running unauthorized database commands. This could let an attacker view or change data behind your website without being noticed. Update the plugin to the latest version or remove it if you cannot apply the update.

What to do
  • Update unlimited elements unlimited elements for elementor (free widgets, addons, templates) to version 2.0.21.
Affected software
VendorProductAffected versions
unlimited elements unlimited elements for elementor (free widgets, addons, templates) <= 2.0.20
Fix: upgrade to 2.0.21
Original advisory text
WordPress Unlimited Elements For Elementor (Free Widgets, Addons, Templates) plugin <= 2.0.20 - SQL Injection vulnerability
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Unlimited Elements Unlimited Elements For Elementor (Free Widgets, Addons, Templates) unlimited-elements-for-elementor allows Blind SQL Injection.This issue affects Unlimited Elements For Elementor (Free Widgets, Addons, Templates): from n/a through 2.0.20.
References
Fix within
Internet-facing 14 days
Internal 60 days
  • Not known to be exploited
  • Can be exploited automatically
  • Gives an attacker partial control
Severity
9.3 Critical
Exploitation
<1% chance of attack within 30 days
Type
CWE-89SQL Injection
Timeline
Published4 Oct 2026
Updated15 Oct 2026
First seen4 Oct 2026
Sources
CVE-2026-103355 · NVD
CVE-2026-103355 · MITRE
Track software like this
Free during beta