Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
7.1

Unlimited Elements For Elementor: Malicious Script Injection

CVE-2026-57718 · published 3 months ago
Summary

A security flaw in Unlimited Elements For Elementor, a free plugin for Elementor, allows hackers to inject malicious scripts into websites using the plugin. This can lead to unauthorized actions, such as stealing user data or displaying unwanted content. To protect your site, update the plugin to the latest version, which is 2.0.13 or higher.

Original advisory text
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Unlimited Elements Unlimited Elements For Elementor (Free Widgets, Addons, Templates) unlimited...
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Unlimited Elements Unlimited Elements For Elementor (Free Widgets, Addons, Templates) unlimited-elements-for-elementor allows Reflected XSS.This issue affects Unlimited Elements For Elementor (Free Widgets, Addons, Templates): from n/a through <= 2.0.12.
References
Fix within
Internet-facing 60 days
Internal At next upgrade
  • Not known to be exploited
  • Needs hands-on effort to exploit
  • Gives an attacker partial control
Severity
7.1 High
Exploitation
<1% chance of attack within 30 days
Type
CWE-79Cross-site Scripting (XSS)
Timeline
Published13 Jul 2026
Updated4 Nov 2026
First seen13 Jul 2026
Sources
CVE-2026-57718 · NVD
Track software like this
Free during beta