# CVE-2026-85568: Unlimited Elements for Elementor SQL injection via search parameter

Source: https://junglewise.ai/threats/cve-2026-85568-the-unlimited-elements-for-elementor-wordpress-plugin-before-2-0  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-03. Updated: 2026-10-05  
License: CC BY 4.0 with a link back

CVE-2026-85568 · Severity: medium · CVSS 6.8 · Published 2026-10-03

Unlimited Elements for Elementor is a WordPress plugin that extends the page builder functionality. A vulnerability in versions before 2.0.21 allows unauthenticated attackers to execute SQL injection attacks through an improperly validated search parameter, potentially exposing non-public content stored in the database when a specific widget option is configured away from its default setting.

Technologies: [Unlimited Elements for Elementor](https://junglewise.ai/threats/technologies/unlimited-elements-for-elementor). Vendors: [Unlimited Elements](https://junglewise.ai/threats/vendors/unlimited-elements).

## Quick answers

**Is CVE-2026-85568 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-85568 being exploited in the wild.

**How severe is CVE-2026-85568?** Medium severity, with a CVSS score of 6.8, published 3 October 2026.

**Which products and versions are affected?** Unlimited Elements for Elementor 1.5.139 through 2.0.20.

**Is there a fix for CVE-2026-85568?** Yes: fixed in 2.0.21. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-85568 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-85568?** Check whether you run Unlimited Elements for Elementor at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in 2.0.21

## Technical details

The plugin fails to properly sanitize a search value before using it in a prepared SQL statement rewrite, enabling unauthenticated SQL injection via the 'ucs' parameter. An attacker can exploit this to bypass access controls and retrieve non-public data. The vulnerability requires that a related widget option be configured away from its default state to be exploitable.

## Affected products

- Unlimited Elements Unlimited Elements for Elementor 1.5.139 through 2.0.20

## Timeline

- 2026-10-01: disclosed
- 2026-10-03: advisory

## References

- [https://wpscan.com/vulnerability/f4f2c1c5-ced9-44cb-b605-a7ce12ac867f/](https://wpscan.com/vulnerability/f4f2c1c5-ced9-44cb-b605-a7ce12ac867f/)

## Related threats

- [Unlimited Elements for Elementor stored cross-site scripting](https://junglewise.ai/threats/cve-2026-121579-improper-neutralization-of-input-during-web-page-generation)
- [Unlimited Elements for Elementor stored XSS in RSS feed widget](https://junglewise.ai/threats/cve-2026-116558-the-unlimited-elements-for-elementor-plugin-for-wordpress-is)
- [Unlimited Elements for Elementor reflected XSS](https://junglewise.ai/threats/cve-2026-62007-improper-neutralization-of-input-during-web-page-generation-cross)
- [Unlimited Elements for Elementor PHP local file inclusion](https://junglewise.ai/threats/cve-2026-62121-improper-control-of-filename-for-include-require-statement-in-php)
- [Unlimited Elements for Elementor missing authorization vulnerability](https://junglewise.ai/threats/cve-2026-62023-missing-authorization-vulnerability-in-unlimited-elements)