Executive brief
Unlimited Elements For Elementor is a WordPress plugin that extends the Elementor page builder with additional UI components. The plugin contains a reflected cross-site scripting (XSS) vulnerability in its public AJAX handler that allows unauthenticated attackers to inject and execute arbitrary JavaScript in a visitor's browser. An attacker can exploit this by tricking users into clicking a malicious link, potentially enabling account takeover, session hijacking, or data theft from affected users.
Technical details
The vulnerability is a reflected XSS flaw in the plugin's front-end AJAX handler, which processes the 'formData[id]' parameter without proper input sanitization or output escaping. The vulnerable handler is registered on the public 'wp' AJAX action with no nonce, capability, or referrer checks, making it accessible to unauthenticated users. When an attacker-controlled ID value is interpolated into an exception message and echoed back as HTML (rather than JSON), the browser parses and executes any injected JavaScript. The vulnerability affects all versions up to and including 2.0.17; patched versions should implement input validation, output escaping, and proper AJAX security checks.
Affected products
- Unlimited Elements Unlimited Elements For Elementor up to and including 2.0.17
Timeline
- 2026-09-05: disclosed