# CVE-2026-77150: Unlimited Elements For Elementor plugin reflected XSS via data[name] parameter

Source: https://junglewise.ai/threats/cve-2026-77150-unlimited-elements-for-elementor-plugin-reflected-xss-via-data  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-11. Updated: 2026-09-26  
License: CC BY 4.0 with a link back

CVE-2026-77150 · Severity: medium · CVSS 6.1 · Published 2026-09-11

The Unlimited Elements For Elementor plugin is a widely-used WordPress extension that adds custom elements to the Elementor page builder. The plugin fails to properly sanitize user input in its preview functionality, allowing attackers to inject malicious JavaScript code that executes in a victim's browser. An attacker can exploit this by sending a specially crafted link to a user; if the user clicks the link, their session or sensitive data could be compromised.

Technologies: [Unlimited Elements for Elementor](https://junglewise.ai/threats/technologies/unlimited-elements-for-elementor). Vendors: [Unlimited Elements](https://junglewise.ai/threats/vendors/unlimited-elements).

## Quick answers

**Is CVE-2026-77150 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-77150 being exploited in the wild.

**How severe is CVE-2026-77150?** Medium severity, with a CVSS score of 6.1, published 11 September 2026.

**Which products and versions are affected?** Unlimited Elements for Elementor up to 2.0.16.

**Is there a fix for CVE-2026-77150?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-77150 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-77150?** Check whether you run Unlimited Elements for Elementor at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

This is a Reflected Cross-Site Scripting (XSS) vulnerability in the Unlimited Elements For Elementor plugin affecting versions up to 2.0.16. The vulnerable code fails to sanitize the 'data[name]' parameter before outputting it in responses from the show_preview AJAX action. The attack vector is network-based and requires no authentication; however, the attacker must trick a user into visiting a malicious link. The nonce protection on the AJAX endpoint can be bypassed because the nonce is publicly retrievable from any page that loads the plugin. A successful exploit allows an attacker to execute arbitrary JavaScript in the victim's browser context, potentially stealing session cookies, credentials, or performing actions on behalf of the user.

## Affected products

- Unlimited Elements Unlimited Elements For Elementor up to 2.0.16

## Timeline

- 2026-09-11: disclosed

## References

- [https://plugins.trac.wordpress.org/browser/unlimited-elements-for-elementor/trunk/inc_php/framework/functions.php](https://plugins.trac.wordpress.org/browser/unlimited-elements-for-elementor/trunk/inc_php/framework/functions.php)
- [https://plugins.trac.wordpress.org/browser/unlimited-elements-for-elementor/trunk/inc_php/unitecreator_actions.class.php](https://plugins.trac.wordpress.org/browser/unlimited-elements-for-elementor/trunk/inc_php/unitecreator_actions.class.php)

## Related threats

- [Unlimited Elements for Elementor stored cross-site scripting](https://junglewise.ai/threats/cve-2026-121579-improper-neutralization-of-input-during-web-page-generation)
- [Unlimited Elements for Elementor stored XSS in RSS feed widget](https://junglewise.ai/threats/cve-2026-116558-the-unlimited-elements-for-elementor-plugin-for-wordpress-is)
- [Unlimited Elements for Elementor reflected XSS](https://junglewise.ai/threats/cve-2026-62007-improper-neutralization-of-input-during-web-page-generation-cross)
- [Unlimited Elements for Elementor PHP local file inclusion](https://junglewise.ai/threats/cve-2026-62121-improper-control-of-filename-for-include-require-statement-in-php)
- [Unlimited Elements for Elementor missing authorization vulnerability](https://junglewise.ai/threats/cve-2026-62023-missing-authorization-vulnerability-in-unlimited-elements)