Live › vulnerability › CVE-2026-115593
Go to dashboardUnlimited Elements For Elementor, a WordPress plugin adding Elementor widgets, does not neutralize some input before writing it into a web page, so a crafted link can inject script. An attacker can run JavaScript in a victim's browser on the affected site, such as acting as a logged-in user.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-28 13:33 UTC. All times on this page are UTC.
Sites running Unlimited Elements For Elementor version or earlier are affected, per the description ("from n/a through 2.0.24"). The sources do not say which page or parameter is reachable, so whether a reflected payload works depends on the site's configuration. Sites without the plugin installed can skip it.
2.0.24No product ranges from the sources yet.
unlimited-elements-for-elementor plugin in the WordPress admin under Plugins, or with wp plugin get unlimited-elements-for-elementor --field=versionunlimited-elements-for-elementor to a version newer than 2.0.24, the last version the advisory lists as affectedEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Unlimited Elements Unlimited Elements For Elementor (Free Widgets, Addons, Templates) unlimited-elements-for-elementor allows Reflected XSS.This issue affects Unlimited Elements For Elementor (Free Widgets, Addons, Templates): from n/a through 2.0.24.
This page as .md · .json · in your agent: get_signal("CVE-2026-115593")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.