High · 8.5 CVE-2026-48837 EUVD-2026-31759GHSA-679r-jm2j-3cr6

WordPress Unlimited Elements For Elementor plugin <= 2.0.8 - SQL Injection vulnerability

Published May 25, 2026 · Updated May 26, 2026 · Assigned by Patchstack

Vendor: Unlimited Elements Product: Unlimited Elements For Elementor

Description

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Unlimited Elements For Elementor allows Blind SQL Injection.

This issue affects Unlimited Elements For Elementor: from n/a through 2.0.8.

Affected products

Vendor	Product	Affected	Fixed
Unlimited Elements	Unlimited Elements For Elementor	≤ 2.0.8	—

References

https://patchstack.com/database/wordpress/plugin/unlimited-elements-for-elementor/vulnerability/wordpress-unlimited-elements-for-elementor-free-widgets-addons-templates-plugin-2-0-8-sql-injection-vulnerability?_s_id=cve vdb-entry