{
 "id": "WPSEC-2026-2503",
 "url": "https://wpsec.com/vuln/WPSEC-2026-2503/",
 "json_url": "https://wpsec.com/vuln/WPSEC-2026-2503/advisory.json",
 "markdown_url": "https://wpsec.com/vuln/WPSEC-2026-2503/index.md",
 "title": "Unlimited Elements for Elementor <= 2.0.26 - Unauthenticated Stored Cross-Site Scripting via RSS Feed Data",
 "description": "The Unlimited Elements for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via RSS feed data in all versions up to, and including, 2.0.26 due to insufficient sanitization of feed item fields (titles, descriptions, links and nested fields) before they are passed to widget templates. This makes it possible for attackers who control the content of an RSS feed displayed by an RSS widget, including authenticated contributors who point a widget at a feed they control, to inject arbitrary web scripts in pages that will execute whenever a user accesses an affected page.",
 "plugin": {
  "slug": "unlimited-elements-for-elementor",
  "name": "Unlimited Elements for Elementor",
  "full_name": "Unlimited Elements for Elementor",
  "wordpress_org": "https://wordpress.org/plugins/unlimited-elements-for-elementor/",
  "advisories_url": "https://wpsec.com/vuln/plugin/unlimited-elements-for-elementor/",
  "attacksurface": "https://attacksurface.wpsec.com/plugin/unlimited-elements-for-elementor"
 },
 "type": "XSS",
 "cwe": [
  "CWE-79"
 ],
 "cve": [],
 "cvss": {
  "version": "3.1",
  "score": 5.4,
  "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N",
  "severity": "Medium"
 },
 "affected": {
  "ranges": [
   {
    "from": null,
    "from_inclusive": true,
    "to": "2.0.28",
    "to_inclusive": false
   }
  ],
  "text": [
   "all versions before 2.0.28"
  ]
 },
 "introduced_in": null,
 "fixed_in": "2.0.28",
 "remediation": "Update to 2.0.28 or later.",
 "fix_released": "2026-11-03T15:12:39+00:00",
 "published": "2026-11-04T15:47:10+00:00",
 "updated": "2026-11-04T14:28:12.492948+00:00",
 "also_published_as": null,
 "references": [
  "https://wpsec.com/vuln/WPSEC-2026-2503/",
  "https://plugins.svn.wordpress.org/unlimited-elements-for-elementor/tags/2.0.28/",
  "https://wordpress.org/plugins/unlimited-elements-for-elementor/"
 ],
 "attacksurface_url": "https://attacksurface.wpsec.com/plugin/unlimited-elements-for-elementor",
 "source": "WPSec",
 "license": {
  "name": "CC BY 4.0",
  "url": "https://creativecommons.org/licenses/by/4.0/"
 },
 "usage": {
  "plugin": "Medium",
  "affected_versions": "Medium",
  "as_of": "2026-11-04"
 }
}