CVE-2026-92924
Unlimited Elements For Elementor < 2.0.21 - Subscriber+ Arbitrary Shortcode Execution via get_addon_output_data
CVSS Score
5.4
EPSS Score
0.0%
EPSS Percentile
0th
The Unlimited Elements for Elementor WordPress plugin before 2.0.21 does not check that a request to render widget output comes from a user allowed to make it, allowing users with a role as low as subscriber to have arbitrary WordPress shortcodes executed on the site. Version 2.0.18 removed the subscriber-level access, so from 2.0.18 onward the issue requires a Contributor role or above.
| Vendor | unknown |
| Product | unlimited elements for elementor |
| Published | Oct 2, 2026 |
Stay Ahead of the Next One
Get instant alerts for unknown unlimited elements for elementor
Be the first to know when new medium vulnerabilities affecting unknown unlimited elements for elementor are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
CVSS v3 Breakdown
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N Attack Vector
Attack Complexity
Privileges Required
User Interaction
Scope
Confidentiality
Integrity
Availability
Affected Versions
Unknown / Unlimited Elements for Elementor
0 < 2.0.21
References
Credits
Jakub Herman WPScan