Description

The Unlimited Elements For Elementor plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via 'formData[id]' Parameter in all versions up to, and including, 2.0.17 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link. The front-end AJAX handler is registered on the public 'wp' action with no nonce, capability, or referer check, and the raw attacker-controlled id value is interpolated verbatim into an exception message that is echoed back without escaping; when the response is served as text/html rather than application/json, the browser parses the injected markup.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.1",
  "pubDate": "2026-09-05T08:16:40.600Z",
  "pubdate": "2026-09-05T08:16:40.600Z",
  "executiveSummary": "The Unlimited Elements For Elementor plugin, in versions up to and including 2.0.17, is susceptible to a Reflected Cross-Site Scripting (XSS) vulnerability. This flaw arises from improper handling of user-supplied input within the plugin's front-end AJAX handler, which fails to perform necessary sanitization or output escaping.\nThe vulnerability allows an unauthenticated, remote attacker to execute arbitrary JavaScript within the context of a victim's browser session. By crafting a malicious link containing an injected payload in the 'formData[id]' parameter, an attacker can trick an authenticated user into triggering the script execution.\nThe risk is exacerbated by the lack of security controls on the AJAX endpoint, such as nonce verification, capability checks, or referer validation. Successful exploitation can lead to unauthorized actions performed on behalf of the victim, session hijacking, credential theft, or redirection to malicious domains. Given the plugin's broad integration with WordPress sites, this vulnerability presents a significant security risk to environments where administrative or privileged users frequently interact with the front-end.",
  "technicalDetails": "The root cause of this Reflected XSS vulnerability is the insecure processing of the 'formData[id]' parameter within the plugin's AJAX handler. The component registers an action on the public 'wp' hook, which is exposed to unauthenticated users. The handler retrieves the 'id' value from the 'formData' array and interpolates it directly into an exception message that is returned to the user.\nBecause the server returns this response with a Content-Type header of 'text/html' rather than 'application/json', the browser's rendering engine processes the response as HTML. Consequently, any injected HTML or JavaScript tags within the 'id' parameter are executed by the browser.\nThe exploitation flow is as follows: 1) An attacker identifies the AJAX endpoint registered by the plugin. 2) The attacker constructs a malicious URL incorporating a JavaScript payload within the 'formData[id]' parameter. 3) The attacker distributes this URL, relying on social engineering to entice a victim (such as an administrator) to click the link. 4) Upon clicking, the victim's browser sends a request to the server, which includes the malicious payload. 5) The server-side code catches an error condition or processes the input, embedding the raw, malicious payload into the response body. 6) The browser receives the response, interprets the payload as legitimate script due to the MIME type, and executes the malicious code in the context of the user's session.\nThis vulnerability is strictly a Reflected XSS attack, requiring the victim to interact with the attacker-provided URL. There is no authentication or privilege requirement for the attacker, as the AJAX handler is publicly accessible. The impact is determined by the permissions of the victim; if an administrator triggers the payload, the attacker could theoretically perform administrative actions, modify site content, or extract sensitive data stored within the WordPress database via CSRF or direct API interaction enabled by the stolen session context.\nThe failure to implement standard WordPress security practices—specifically the absence of nonces (wp_create_nonce/wp_verify_nonce) for CSRF protection and the lack of output sanitization functions like esc_html() or esc_js()—creates the critical exposure point. The plugin fails to validate that the request originated from a legitimate source or was authorized by the application's security policies."
}