Vulnerabilities / Unlimited Elements for Elementor / WPSEC-2026-2503
Unlimited Elements for Elementor <= 2.0.26 - Unauthenticated Stored Cross-Site Scripting via RSS Feed Data
Medium 5.4
CWE-79Fixed in 2.0.28
- ID
- WPSEC-2026-2503
- Plugin
- Unlimited Elements for Elementor (unlimited-elements-for-elementor)
- Affected
- all versions before 2.0.28
- Remediation
- Update to 2.0.28 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N
- Weakness
- CWE-79
- Usage
- Plugin Medium · Affected versions Medium among sites WPSec scans, 2026-11-04
- Attack surface
- Unlimited Elements for Elementor on WPSec AttackSurface
- Fix released
- Published
Description
The Unlimited Elements for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via RSS feed data in all versions up to, and including, 2.0.26 due to insufficient sanitization of feed item fields (titles, descriptions, links and nested fields) before they are passed to widget templates. This makes it possible for attackers who control the content of an RSS feed displayed by an RSS widget, including authenticated contributors who point a widget at a feed they control, to inject arbitrary web scripts in pages that will execute whenever a user accesses an affected page.
References
- https://wpsec.com/vuln/WPSEC-2026-2503/
- https://plugins.svn.wordpress.org/unlimited-elements-for-elementor/tags/2.0.28/
- https://wordpress.org/plugins/unlimited-elements-for-elementor/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS