Description
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Unlimited Elements Unlimited Elements For Elementor (Free Widgets, Addons, Templates) unlimited-elements-for-elementor allows Blind SQL Injection.This issue affects Unlimited Elements For Elementor (Free Widgets, Addons, Templates): from n/a through 2.0.20.
Published: 2026-10-01
Score: 8.5 High
EPSS: < 1% Very Low
KEV: No
Impact: Blind SQL Injection
Action: Immediate Patch
AI Analysis

Impact

The vulnerability is an improper neutralization of special characters in an SQL command, allowing an attacker to perform Blind SQL Injection against the Unlimited Elements For Elementor WordPress plugin. The weakness is identified as CWE-89. An attacker who can supply crafted input to the vulnerable endpoint can read, modify, or delete data stored in the WordPress database, potentially compromising the confidentiality, integrity, and availability of site content and user information.

Affected Systems

The affected product is the Unlimited Elements For Elementor (Free Widgets, Addons, Templates) WordPress plugin. All installations from the initial release through version 2.0.20 are vulnerable. Users running any of these versions on any WordPress installation are at risk.

Risk and Exploitability

The CVSS score of 8.5 indicates a high severity, while the EPSS score is not available. The vulnerability is not listed in the CISA KEV catalog. Based on the description, the likely attack vector is remote via web requests that manipulate plugin parameters; authentication is not required for the vulnerable endpoint, implying an unauthenticated attacker could exploit the flaw.

Generated by OpenCVE AI on October 1, 2026 at 15:02 UTC.

Remediation

Vendor Solution

Update the WordPress Unlimited Elements For Elementor (Free Widgets, Addons, Templates) plugin to the latest available version (at least 2.0.21).

OpenCVE Recommended Actions

  • Update the Unlimited Elements For Elementor plugin to version 2.0.21 or later.
  • If the plugin is not required for site functionality, disable or uninstall it entirely.
  • Restrict access to the WordPress administration area to trusted users and monitor requests for unusual or repeated input patterns that could indicate an injection attempt.

Generated by OpenCVE AI on October 1, 2026 at 15:02 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Thu, 01 Oct 2026 14:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Thu, 01 Oct 2026 13:00:00 +0000

Type Values Removed Values Added
Description Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Unlimited Elements Unlimited Elements For Elementor (Free Widgets, Addons, Templates) unlimited-elements-for-elementor allows Blind SQL Injection.This issue affects Unlimited Elements For Elementor (Free Widgets, Addons, Templates): from n/a through 2.0.20.
Title WordPress Unlimited Elements For Elementor (Free Widgets, Addons, Templates) plugin <= 2.0.20 - SQL Injection vulnerability
Weaknesses CWE-89
References
Metrics cvssV3_1

{'score': 8.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:L'}

Subscriptions

No data.

cve-icon MITRE

Status: PUBLISHED

Assigner: Patchstack

Published:

Updated: 2026-10-01T13:18:39.859Z

Reserved: 2026-09-30T12:43:33.093Z

Link: CVE-2026-103338

cve-icon Vulnrichment

Updated: 2026-10-01T13:18:37.053Z

cve-icon NVD

Status : Deferred

Published: 2026-10-01T13:17:08.350

Modified: 2026-10-01T14:34:35.357

Link: CVE-2026-103338

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-01T15:15:10Z

Weaknesses
  • CWE-89

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')