CVE-2026-62007 · Package
NO FIX YET · SEE WHAT TO DO
Unlimited Elements For Elementor, a WordPress plugin of free widgets, addons and templates, fails to neutralize input in generated pages, enabling reflected cross-site scripting. An attacker can get scripts to run in a victim's browser on the affected site, for example by tricking them into opening a crafted link.
first public Nov 4, 2026 · 1 source
Is this in your stack? Find out in 2 minutes.
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
Sites running the Unlimited Elements For Elementor WordPress plugin at version 2.0.26 or earlier are exposed. The flaw is reflected XSS, so exploitation typically needs a victim to open a crafted link; sites that do not have the plugin installed are not affected. Whether authentication or a non-default setting is required is unknown from the sources.
Not affected if plugin-not-installed
Who cares elementor, unlimited-elements-for-elementor, wordpress
unlimited-elements-for-elementor in the WordPress admin plugins list or with wp plugin get unlimited-elements-for-elementor --field=version2.0.262.0.26Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Unlimited Elements Unlimited Elements For Elementor (Free Widgets, Addons, Templates) unlimited-elements-for-elementor allows Reflected XSS.This issue affects Unlimited Elements For Elementor (Free Widgets, Addons, Templates): from n/a through 2.0.26.
This page as .md · .json · in your agent: get_signal("CVE-2026-62007") · CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.