Description
The Unlimited Elements For Elementor plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via 'formData[id]' Parameter in all versions up to, and including, 2.0.17 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link. The front-end AJAX handler is registered on the public 'wp' action with no nonce, capability, or referer check, and the raw attacker-controlled id value is interpolated verbatim into an exception message that is echoed back without escaping; when the response is served as text/html rather than application/json, the browser parses the injected markup.
Published: 2026-09-05
Score: 6.1 Medium
EPSS: n/a
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

Unlimited Elements For Elementor, a WordPress plugin, contains a reflected cross‑site scripting flaw triggered by the formData[id] parameter. An attacker can embed malicious JavaScript that is echoed back in an exception message without escaping when the AJAX handler returns text/html. When an affected user visits a crafted link, the script runs in the victim’s browser, potentially stealing session cookies, defacing content, or loading additional payloads.

Affected Systems

The flaw affects the UniteCMS Unlimited Elements For Elementor plugin for WordPress in all releases through version 2.0.17. It is relevant to any WordPress installation that has the plugin installed and publicly accessible.

Risk and Exploitability

With a CVSS base score of 6.1, the vulnerability is of moderate severity. The public AJAX endpoint is registered on the wp action without any nonce or capability checks, meaning no authentication is required for exploitation. The EPSS score is not available, and the flaw is not listed in the CISA KEV catalog. Attackers can trigger the flaw by crafting a link that targets the formData[id] parameter, and the response is parsed as HTML, allowing the injected script to execute.

Generated by OpenCVE AI on September 5, 2026 at 08:22 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Update the Unlimited Elements For Elementor plugin to version 2.0.18 or newer.
  • If an update cannot be performed, uninstall or disable the plugin to remove the vulnerable endpoint.
  • In the meantime, consider blocking access to the wp formData AJAX handler through a firewall or web‑application firewall rule until an official fix is applied.

Generated by OpenCVE AI on September 5, 2026 at 08:22 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Sat, 05 Sep 2026 08:45:00 +0000

Type Values Removed Values Added
First Time appeared Unitecms
Unitecms unlimited Elements For Elementor
Wordpress
Wordpress wordpress
Vendors & Products Unitecms
Unitecms unlimited Elements For Elementor
Wordpress
Wordpress wordpress

Sat, 05 Sep 2026 07:45:00 +0000

Type Values Removed Values Added
Description The Unlimited Elements For Elementor plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via 'formData[id]' Parameter in all versions up to, and including, 2.0.17 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link. The front-end AJAX handler is registered on the public 'wp' action with no nonce, capability, or referer check, and the raw attacker-controlled id value is interpolated verbatim into an exception message that is echoed back without escaping; when the response is served as text/html rather than application/json, the browser parses the injected markup.
Title Unlimited Elements For Elementor <= 2.0.17 - Reflected Cross-Site Scripting via 'formData[id]' Parameter
Weaknesses CWE-79
References
Metrics cvssV3_1

{'score': 6.1, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N'}

Subscriptions

Unitecms Unlimited Elements For Elementor
Wordpress Wordpress
cve-icon MITRE

Status: PUBLISHED

Assigner: Wordfence

Published:

Updated: 2026-09-05T07:38:13.398Z

Reserved: 2026-08-17T22:07:51.575Z

Link: CVE-2026-75586

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Received

Published: 2026-09-05T08:16:40.600

Modified: 2026-09-05T08:16:40.600

Link: CVE-2026-75586

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-09-05T08:30:06Z

Weaknesses
  • CWE-79

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')