CVE-2026-18561
HighCVSS 7.5Exploitation Probability (EPSS)
Low risk26th percentile - higher than 26% of all known CVEs
Summary
The Unlimited Elements For Elementor plugin for WordPress (versions up to and including 2.0.16) is vulnerable to SQL Injection via the 'addontype' parameter due to insufficient escaping and lack of preparation in the getWhereString() function. An unauthenticated attacker can append additional SQL queries to extract sensitive information from the database.
Risk Assessment
An unauthenticated attacker can exfiltrate confidential data from the database, including user data and site configuration.
Recommendation
Update the plugin to a version newer than 2.0.16 or disable it if no fix is available.
Other vulnerabilities in Unlimited Elements For Elementor
See all- CVE-2026-103341Medium
Unlimited Elements For Elementor plugin has a missing authorization vulnerability, allowing exploitation of incorrectly configured access control levels. Affects versions up to 2.0.20.
- CVE-2026-103338High
The Unlimited Elements For Elementor (Free Widgets, Addons, Templates) WordPress plugin contains an SQL Injection (Blind SQL Injection) vulnerability caused by improper neutralization of special elements in SQL commands. The issue affects versions from n/a through 2.0.20.
- CVE-2026-66608Medium
The Unlimited Elements For Elementor plugin in versions up to and including 2.0.19 contains a Server Side Request Forgery (SSRF) vulnerability. A user with Contributor privileges can force the server to make requests to arbitrary resources.
- CVE-2026-103355Critical
The Unlimited Elements For Elementor plugin up to version 2.0.20 contains a blind SQL injection vulnerability. An attacker can exploit this flaw to manipulate database queries without knowing the database structure.
- CVE-2026-62121Medium
The Unlimited Elements For Elementor plugin through 2.0.26 contains an improper control of filename for include/require statement in PHP (PHP Remote File Inclusion) vulnerability, allowing PHP Local File Inclusion.
- CVE-2026-62023Medium
The Unlimited Elements For Elementor plugin through 2.0.26 contains a missing authorization vulnerability. This allows exploitation of incorrectly configured access control security levels.
- CVE-2026-115593High
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Unlimited Elements Unlimited Elements For Elementor (Free Widgets, Addons, Templates) unlimited-elements-for-elementor allows Reflected XSS. This issue affects Unlimited Elements For Elementor (Free Widgets, Addons, Templates): from n/a through 2.0.24.
- CVE-2026-95534High
The Unlimited Elements For Elementor WordPress plugin through 2.0.19 is vulnerable to deserialization of untrusted data, allowing object injection.
- CVE-2026-94662High
Stored XSS vulnerability in Unlimited Elements For Elementor plugin. Improper input neutralization during web page generation allows persistent injection of malicious script that executes on every page view. Affects versions from n/a through 2.0.19.
- CVE-2026-105064Medium
A Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection') vulnerability in Unlimited Elements For Elementor (Free Widgets, Addons, Templates) unlimited-elements-for-elementor allows Parameter Injection. This issue affects the plugin from n/a through 2.0.22.
Original NVD description (English source)
The Unlimited Elements For Elementor plugin for WordPress is vulnerable to SQL Injection via the 'addontype' parameter in versions up to, and including, 2.0.16. This is due to insufficient escaping on the user-supplied parameter and the lack of sufficient preparation on the existing SQL query in the getWhereString() function; when the parameter is supplied as an array, element zero is used verbatim as the SQL comparison operator and concatenated into the WHERE clause without sanitization, while normalizeAjaxInputData() strips WordPress's magic_quotes protection from the value. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS