WordPress Plugin Vulnerabilities

Unlimited Elements For Elementor < 2.0.21 - Contributor+ Stored XSS via Icon Library Parameter

Description

The plugin does not escape an icon value before concatenating it into an HTML attribute in its shared widget-parameter processor, allowing users with Contributor access (who do not hold unfiltered_html) to store a payload that executes when the page is rendered.

Proof of Concept

Affects Plugins

Plugin icon
unlimited-elements-for-elementor
Fixed in 2.0.21

References

CVE
CVE-2026-85016

Classification

Type
XSS
OWASP top 10
A7: Cross-Site Scripting (XSS)
CWE
CWE-79
CVSS
6.8 (medium)

Miscellaneous

Original Researcher
Revanth Hari Narayana Matte
Submitter
Revanth Hari Narayana Matte
Verified
Yes
WPVDB ID
1d488c84-2797-4c02-8c13-54b80e4128dc

Timeline

Publicly Published
2026-09-30 (about 2 days ago)
Added
2026-09-30 (about 1 day ago)
Last Updated
2026-09-30 (about 1 day ago)

Other

Published
Title
Published
2024-06-03
Title
SureTriggers – Connect All Your Plugins, Apps, Tools & Automate Everything! < 1.0.48 - Authenticated (Contributor+) Stored Cross-Site Scripting via Trigger Link Shortcode
Published
2026-09-03
Title
Bold Page Builder < 5.9.8 - Contributor+ Stored XSS via bt_bb_button/bt_bb_headline/bt_bb_icon URL
Published
2025-09-22
Title
Page-list <= 5.8 - Contributor+ Stored XSS
Published
2022-04-15
Title
KB Support < 1.5.6 - Unauthenticated Stored Cross-Site Scripting
Published
2023-01-06
Title
Posts List Designer by Category < 3.2 - Contributor+ Stored XSS via Shortcode