Executive brief
The Unlimited Elements For Elementor plugin is a widely-used WordPress extension that adds custom elements to the Elementor page builder. The plugin fails to properly sanitize user input in its preview functionality, allowing attackers to inject malicious JavaScript code that executes in a victim's browser. An attacker can exploit this by sending a specially crafted link to a user; if the user clicks the link, their session or sensitive data could be compromised.
Technical details
This is a Reflected Cross-Site Scripting (XSS) vulnerability in the Unlimited Elements For Elementor plugin affecting versions up to 2.0.16. The vulnerable code fails to sanitize the 'data[name]' parameter before outputting it in responses from the show_preview AJAX action. The attack vector is network-based and requires no authentication; however, the attacker must trick a user into visiting a malicious link. The nonce protection on the AJAX endpoint can be bypassed because the nonce is publicly retrievable from any page that loads the plugin. A successful exploit allows an attacker to execute arbitrary JavaScript in the victim's browser context, potentially stealing session cookies, credentials, or performing actions on behalf of the user.
Affected products
- Unlimited Elements Unlimited Elements For Elementor up to 2.0.16
Timeline
- 2026-09-11: disclosed