The Unlimited Elements for Elementor plugin, a WordPress add‑on that extends Elementor’s functionality, contains a SQL injection flaw that can be triggered via the 'data[filter_search]' parameter in the get_cat_addons AJAX action. Because the plugin removes WordPress’s magic quotes and then uses deprecated escaping functions, the parameter is concatenated directly into a LIKE clause without proper sanitization, allowing an authenticated attacker with Contributor or higher privileges to inject arbitrary SQL and export sensitive data. This weakness corresponds to CWE‑89.

Vendor unitecms, product Unlimited Elements for Elementor. Versions up to and including 2.0.7 are affected. WordPress sites running these releases are vulnerable.

The CVSS score of 6.5 indicates moderate severity. EPSS is not available, and the vulnerability is not listed in CISA KEV, suggesting it is not a known actively exploited issue. The likely attack vector is interaction with the Elementor editor’s AJAX endpoint, which an authenticated Contributor or higher user can invoke with a valid nonce. No public exploitation reports exist, but the presence of the injection path means that a determined attacker could compromise the database if privileged access is available.