# CVE-2026-92923: Unlimited Elements for Elementor SQL injection via unsanitized parameter

Source: https://junglewise.ai/threats/cve-2026-92923-the-unlimited-elements-for-elementor-wordpress-plugin-before-2-0  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-03. Updated: 2026-10-05  
License: CC BY 4.0 with a link back

CVE-2026-92923 · Severity: medium · CVSS 6.3 · Published 2026-10-03

Unlimited Elements for Elementor is a WordPress plugin that adds advanced page-building functionality to Elementor. A SQL injection vulnerability in the get_addon_output_data parameter allows authenticated users (as low as Subscriber role, or Contributor and above in version 2.0.18+) to read arbitrary data from the WordPress database, potentially exposing sensitive site information and user credentials.

Technologies: [Unlimited Elements for Elementor](https://junglewise.ai/threats/technologies/unlimited-elements-for-elementor). Vendors: [Unlimited Elements](https://junglewise.ai/threats/vendors/unlimited-elements).

## Quick answers

**Is CVE-2026-92923 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-92923 being exploited in the wild.

**How severe is CVE-2026-92923?** Medium severity, with a CVSS score of 6.3, published 3 October 2026.

**Which products and versions are affected?** Unlimited Elements for Elementor 1.5.142 to 2.0.20.

**Is there a fix for CVE-2026-92923?** Yes: fixed in 2.0.21. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-92923 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2026-92923?** Check whether you run Unlimited Elements for Elementor at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in 2.0.21

## Technical details

The plugin fails to properly sanitize and escape user input in the get_addon_output_data parameter before using it in a SQL query, enabling blind SQL injection attacks. Users with Subscriber role can exploit this in versions before 2.0.18; version 2.0.18 and later require at least Contributor role. The vulnerability allows attackers to extract arbitrary data from the database through time-based or other blind SQL injection techniques.

## Affected products

- Unlimited Elements Unlimited Elements for Elementor 1.5.142 to 2.0.20

## Timeline

- 2026-10-01: disclosed
- 2026-10-03: advisory

## References

- [https://wpscan.com/vulnerability/1d02096b-81c4-421b-a7d3-b0ed7b1d173b/](https://wpscan.com/vulnerability/1d02096b-81c4-421b-a7d3-b0ed7b1d173b/)

## Related threats

- [Unlimited Elements for Elementor stored cross-site scripting](https://junglewise.ai/threats/cve-2026-121579-improper-neutralization-of-input-during-web-page-generation)
- [Unlimited Elements for Elementor stored XSS in RSS feed widget](https://junglewise.ai/threats/cve-2026-116558-the-unlimited-elements-for-elementor-plugin-for-wordpress-is)
- [Unlimited Elements for Elementor reflected XSS](https://junglewise.ai/threats/cve-2026-62007-improper-neutralization-of-input-during-web-page-generation-cross)
- [Unlimited Elements for Elementor PHP local file inclusion](https://junglewise.ai/threats/cve-2026-62121-improper-control-of-filename-for-include-require-statement-in-php)
- [Unlimited Elements for Elementor missing authorization vulnerability](https://junglewise.ai/threats/cve-2026-62023-missing-authorization-vulnerability-in-unlimited-elements)