# Unlimited Elements for Elementor <= 2.0.26 - Unauthenticated Stored Cross-Site Scripting via RSS Feed Data

- **ID:** WPSEC-2026-2503
- **Plugin:** Unlimited Elements for Elementor (`unlimited-elements-for-elementor`), https://wordpress.org/plugins/unlimited-elements-for-elementor/
- **Affected versions:** all versions before 2.0.28
- **Fixed in:** 2.0.28 (Update to 2.0.28 or later.)
- **Severity:** Medium 5.4 (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N)
- **Weakness:** CWE-79
- **Usage among sites WPSec scans:** plugin Medium, affected versions Medium (as of 2026-11-04)
- **Attack surface analysis:** https://attacksurface.wpsec.com/plugin/unlimited-elements-for-elementor
- **Fix released:** 2026-11-03
- **Published:** 2026-11-04
- **URL:** https://wpsec.com/vuln/WPSEC-2026-2503/

## Description

The Unlimited Elements for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via RSS feed data in all versions up to, and including, 2.0.26 due to insufficient sanitization of feed item fields (titles, descriptions, links and nested fields) before they are passed to widget templates. This makes it possible for attackers who control the content of an RSS feed displayed by an RSS widget, including authenticated contributors who point a widget at a feed they control, to inject arbitrary web scripts in pages that will execute whenever a user accesses an affected page.

## References

- https://wpsec.com/vuln/WPSEC-2026-2503/
- https://plugins.svn.wordpress.org/unlimited-elements-for-elementor/tags/2.0.28/
- https://wordpress.org/plugins/unlimited-elements-for-elementor/

Source: WPSec, https://wpsec.com/vuln/WPSEC-2026-2503/

License: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). Free to use, share and adapt, also commercially, if you credit WPSec and link to this advisory.