CVE-2026-62007

WordPress Unlimited Elements For Elementor (Free Widgets, Addons, Templates) plugin <= 2.0.26 - Cross Site Scripting (XSS) vulnerability

State: published CNA: Patchstack CVSS 3.1 7.1 High NVD: deferred

Description

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Unlimited Elements Unlimited Elements For Elementor (Free Widgets, Addons, Templates) unlimited-elements-for-elementor allows Reflected XSS.This issue affects Unlimited Elements For Elementor (Free Widgets, Addons, Templates): from n/a through 2.0.26.

Affected products

Vendor	Product	Versions
Unlimited Elements	Unlimited Elements For Elementor (Free Widgets, Addons, Templates)	≤2.0.26

References

External links from the record. They lead to third-party sites.

https://patchstack.com/database/wordpress/plugin/unlimited-elements-for-elementor/vulnerability/wordpress-unlimited-elem… vdb-entry

Dates

Reserved: 2026-07-13
Published: 2026-11-04
Updated: 2026-11-04

CVSS

7.1 High

Version: 3.1
Source: CNA (Patchstack)
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L

EPSS

0.146% probability of exploitation activity in the next 30 days

Percentile: 3.854%
Score date: 2026-11-04
Model: v2026.06.15

Weakness

CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

NVD

Status: Deferred
Published: 2026-11-04
Modified: 2026-11-04

7.1 High CVSS 3.1 · Patchstack, secondary
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L

This CVE at nvd.nist.gov