WordPress Plugin Vulnerabilities

Unlimited Elements For Elementor < 2.0.13 - Unauthenticated Stored Cross-Site Scripting

Description

The plugin is vulnerable to Stored Cross-Site Scripting due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

Affects Plugins

Plugin icon
unlimited-elements-for-elementor
Fixed in 2.0.13

References

CVE
CVE-2026-57718
URL
https://www.wordfence.com/threat-intel/vulnerabilities/id/183282c6-2069-4fb5-acbd-539aea265d74

Classification

Type
XSS
OWASP top 10
A7: Cross-Site Scripting (XSS)
CWE
CWE-79
CVSS
7.2 (high)

Miscellaneous

Original Researcher
Taylsec
Verified
No
WPVDB ID
4ab7469c-993a-4b0c-a3a0-8741a9fcccfb

Timeline

Publicly Published
2026-07-09 (about 3 months ago)
Added
2026-07-16 (about 3 months ago)
Last Updated
2026-07-16 (about 3 months ago)

Other

Published
Title
Published
2025-09-26
Title
User Notes < 1.0.3 - Admin+ Stored XSS
Published
2014-08-01
Title
Nmedia MailChimp 3.1 - api_mailchimp/postToMailChimp.php abs_path Parameter XSS
Published
2025-01-06
Title
Role Includer <= 1.6 - Reflected Cross-Site Scripting via user_id Parameter
Published
2024-10-01
Title
WordPress Infinite Scroll - Ajax Load More < 7.1.3 - Contributor+ Stored XSS
Published
2020-06-11
Title
WordPress < 5.4.2 - Authenticated Stored XSS via Theme Upload