CVE-2026-92923
Unlimited Elements For Elementor 1.5.142 - 2.0.20 - Subscriber+ SQLi via get_addon_output_data
CVSS Score
0.0
EPSS Score
0.0%
EPSS Percentile
0th
The Unlimited Elements for Elementor WordPress plugin before 2.0.21 does not sanitise and escape a parameter before using it in a SQL statement, allowing users with a role as low as subscriber to perform blind SQL injection attacks and read arbitrary data from the database. Version 2.0.18 removed the subscriber-level access, so from 2.0.18 onward the issue requires a Contributor role or above.
| Vendor | unknown |
| Product | unlimited elements for elementor |
| Published | Oct 3, 2026 |
Stay Ahead of the Next One
Get instant alerts for unknown unlimited elements for elementor
Be the first to know when new unknown vulnerabilities affecting unknown unlimited elements for elementor are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
Affected Versions
Unknown / Unlimited Elements for Elementor
1.5.142 < 2.0.21
References
Credits
Jakub Herman WPScan