Description

Unauthenticated Cross Site Scripting (XSS) in Unlimited Elements For Elementor (Free Widgets, Addons, Templates) <= 2.0.17 versions.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.1",
  "pubDate": "2026-09-08T08:17:13.673Z",
  "pubdate": "2026-09-08T08:17:13.673Z",
  "executiveSummary": "The Unlimited Elements For Elementor plugin, in versions up to 2.0.17, contains an unauthenticated Cross-Site Scripting (XSS) vulnerability. This flaw allows remote, unauthenticated attackers to inject malicious JavaScript into the plugin's interface, which is subsequently executed within the context of a victim's browser session.\nThe vulnerability stems from improper sanitization of user-supplied input before rendering it in the administrative or public-facing views. Successful exploitation could lead to unauthorized actions performed on behalf of an administrator, session hijacking, credential theft, or unauthorized redirection of users.\nAs this vulnerability does not require authentication, the attack vector is exposed to the public internet, significantly increasing the risk. It allows an attacker to compromise the integrity and confidentiality of the WordPress environment by executing arbitrary scripts in the context of other users, including those with elevated privileges.\nImmediate action is required to mitigate this risk, primarily through updating to a patched version once available or implementing restrictive WAF rules to block malicious payload delivery.",
  "technicalDetails": "The vulnerability resides within the Unlimited Elements For Elementor plugin, versions <= 2.0.17. It is classified as a reflected or stored Cross-Site Scripting (XSS) flaw, depending on the specific endpoint implementation and payload persistence. The root cause is the failure to properly sanitize or escape input parameters before they are processed by the plugin's rendering engine and outputted to the Document Object Model (DOM).\nIn the context of the WordPress plugin architecture, the affected component fails to utilize standard WordPress security functions such as sanitize_text_field() or esc_html() when handling user input delivered via GET or POST requests. Consequently, an attacker can supply malicious JavaScript payloads within these parameters.\nThe attack flow proceeds as follows: An attacker crafts a malicious URL containing a JavaScript payload within one of the vulnerable plugin parameters. This payload may be designed to exfiltrate sensitive data, such as session cookies (e.g., WordPress authentication tokens), or to perform administrative actions such as creating a new administrative user or modifying plugin configurations. When an unsuspecting user, particularly an administrator, clicks the malicious link or interacts with a page where the malicious input is rendered, the payload is executed within their browser session.\nBecause the payload executes in the context of the victim's session, the attacker can leverage the victim's authentication to bypass security controls. If the victim is an administrator, the attacker can achieve full site compromise by performing actions that the administrator is authorized to do, such as installing malicious plugins or modifying sensitive settings.\nThe lack of authentication requirements means that any remote, unauthenticated attacker can initiate the exploitation process. The vulnerability is network-exposed, requiring only that the attacker can reach the targeted WordPress instance. The payload behavior is limited only by the attacker's capability to craft valid JavaScript, which can be used to manipulate the DOM, send asynchronous requests, or perform sophisticated client-side attacks.\nPost-exploitation impact includes complete administrative account takeover, modification of site content, potential redirection to malicious external sites, and further compromise of the underlying server if administrative capabilities are misused to execute arbitrary server-side code."
}