WordPress Unlimited Elements For Elementor (Free Widgets, Addons, Templates) plugin <= 2.0.20 - SQL Injection vulnerability

Why this deserves its current priority

CVSS is 8.5. The current sources do not mark it as known exploited. Treat this as a source-backed prioritization signal, not a statement about your environment.

Affected scope and exposure questions

The current feed maps Unlimited Elements/unlimited-elements-for-elementor (generic). Check affected ranges and fixed versions before updating.

Recommended response

1. 1Check inventory. Check lockfiles and deployed manifests for Unlimited Elements/unlimited-elements-for-elementor.
2. 2Review the reported fix. Source-reported solution: Update the WordPress Unlimited Elements For Elementor (Free Widgets, Addons, Templates) plugin to the latest available version (at least 2.0.21).

Evidence timeline and material changes

1. Published upstream

   Oct 1, 2026

   Evidence: source:cvelist:source_dates:source-dates:record

2. Source modified

   Oct 1, 2026

   Evidence: source:cvelist:source_dates:source-dates:record

3. First seen by HOL

   Oct 1, 2026

Sources and claim methodology

• Source referencepatchstack.com

Related CVEs

• WordPress BuildKit – Product Builder for WooCommerce – Custom PC Builder plugin <= 1.0.28 - SQL Injection vulnerabilityAlso CWE-89
• WordPress Ultimate Member plugin <= 2.13.1 - SQL Injection vulnerabilityAlso CWE-89
• WordPress Captivate Sync plugin <= 3.3.2 - SQL Injection vulnerabilityAlso CWE-89
• WordPress WordPress File Upload plugin <= 5.1.10 - SQL Injection vulnerabilityAlso CWE-89
• Sharp Multifunction Printers Local File Inclusion via installed_emanual_down.htmlSame generic ecosystem
• WordPress REST API Log plugin <= 1.7.2 - Insecure Direct Object References (IDOR) vulnerabilitySame generic ecosystem