{"id":"CVE-2026-62007","kind":"vulnerability","aliases":["CVE-2026-62007"],"related":[],"title":"Unlimited Elements for Elementor: reflected XSS lets attackers run scripts in visitors' browsers","description":"Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Unlimited Elements Unlimited Elements For Elementor (Free Widgets, Addons, Templates) unlimited-elements-for-elementor allows Reflected XSS.This issue affects Unlimited Elements For Elementor (Free Widgets, Addons, Templates): from n/a through 2.0.26.","summary":"Unlimited Elements For Elementor, a WordPress plugin of free widgets, addons and templates, fails to neutralize input in generated pages, enabling reflected cross-site scripting. An attacker can get scripts to run in a victim's browser on the affected site, for example by tricking them into opening a crafted link.","severity":"high","cvss":7.1,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["elementor","package","unlimited-elements-for-elementor","wordpress"],"not_affected_if":["plugin-not-installed"],"how_to_check":"- Check the installed plugin version of `unlimited-elements-for-elementor` in the WordPress admin plugins list or with `wp plugin get unlimited-elements-for-elementor --field=version`\n- Compare it against the affected range: all versions through `2.0.26`","fix":"- Unlimited Elements For Elementor: a fixed version is not stated in the sources; affected range is through `2.0.26`","status":"open","published_at":"2026-11-04T08:17:17+00:00","first_seen_at":"2026-11-04T08:26:00+00:00","triaged_at":"2026-11-04T08:26:28+00:00","updated_at":"2026-11-04T08:26:28+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-11-04T08:26:28Z","model":"claude-haiku-5-5","output":{"fix":"- Unlimited Elements For Elementor: a fixed version is not stated in the sources; affected range is through `2.0.26`","reach":"internet","title":"Unlimited Elements for Elementor: reflected XSS lets attackers run scripts in visitors' browsers","impact":"medium","summary":"Unlimited Elements For Elementor, a WordPress plugin of free widgets, addons and templates, fails to neutralize input in generated pages, enabling reflected cross-site scripting. An attacker can get scripts to run in a victim's browser on the affected site, for example by tricking them into opening a crafted link.","audience":"businesses","category":"package","nicknames":[],"who_cares":["wordpress","elementor","unlimited-elements-for-elementor"],"confidence":0.6,"fix_status":"unknown","needs_auth":"unknown","worst_case":"Attacker runs scripts in victims' browsers on the affected site","analyst_note":"Confirm the fixed version and whether the reflected input path requires login, using the NVD entry and the plugin vendor's changelog.","how_to_check":"- Check the installed plugin version of `unlimited-elements-for-elementor` in the WordPress admin plugins list or with `wp plugin get unlimited-elements-for-elementor --field=version`\n- Compare it against the affected range: all versions through `2.0.26`","plain_action":"","needs_analyst":true,"not_affected_if":["plugin-not-installed"],"who_is_affected":"Sites running the Unlimited Elements For Elementor WordPress plugin at version 2.0.26 or earlier are exposed. The flaw is reflected XSS, so exploitation typically needs a victim to open a crafted link; sites that do not have the plugin installed are not affected. Whether authentication or a non-default setting is required is unknown from the sources.","user_interaction":"yes","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000751,"input_tokens":4173,"output_tokens":667,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-2026':15A,18A '-62007':16A,19A '2.0.26':125C 'addon':38B,102C,120C 'affect':68B,113C 'allow':109C 'attack':8A,55B 'browser':13A,65B 'craft':78B 'cross':51B,89C 'cross-sit':50B,88C 'cve':14A,17A 'element':2A,24B,29B,95C,97C,106C,115C 'elementor':4A,20B,26B,31B,99C,108C,117C 'enabl':48B 'exampl':71B 'fail':41B 'free':36B,100C,118C 'generat':46B,87C 'get':57B 'improp':80C 'input':44B,83C 'issu':112C 'let':7A 'link':79B 'n/a':123C 'neutral':43B,81C 'open':76B 'packag':21B 'page':47B,86C 'plugin':34B 'reflect':5A,49B,110C 'run':9A,60B 'script':10A,53B,58B,91C 'site':52B,69B,90C 'templat':40B,103C,121C 'trick':73B 'unlimit':1A,23B,28B,94C,96C,105C,114C 'unlimited-elements-for-elementor':22B,104C 'victim':63B 'visitor':12A 'vulner':92C 'web':85C 'widget':37B,101C,119C 'wordpress':27B,33B 'xss':6A 'xss.this':111C","nicknames":[],"mitigations":[],"who_affected":"Sites running the Unlimited Elements For Elementor WordPress plugin at version 2.0.26 or earlier are exposed. The flaw is reflected XSS, so exploitation typically needs a victim to open a crafted link; sites that do not have the plugin installed are not affected. Whether authentication or a non-default setting is required is unknown from the sources.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"unknown","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["elementor","high","package","unlimitedelementsforelementor","wordpress"],"campaign_type":null,"first_public_at":"2026-11-04T08:17:17+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L","cvss_by":"audit@patchstack.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-62007","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-62007","severity":null,"published_at":"2026-11-04T08:17:17+00:00","modified_at":"2026-11-04T08:17:17+00:00","first_seen_at":"2026-11-04T08:26:00+00:00","fetched_at":"2026-11-04T08:26:00+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}