Unitecms vulnerabilities
We track 16 vulnerabilities in Unitecms products across 6 products. 16 are rated high or critical, and none are known to be exploited. The most recent was published on November 7, 2026.
Latest Unitecms vulnerabilities
- 7.2 High severity
Unlimited Elements for Elementor: Improper Neutralization of Input During Web Page Generation
The Unlimited Elements for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the '<title>/<description> inside the attacker-controlled RSS feed body' parameter in all versions up to, and including, 2.0.26 due to insufficient input
- 7.5 High severity
Unlimited Elements For Elementor: Improper Neutralization of Special Elements used in an SQL Command
The Unlimited Elements For Elementor plugin for WordPress is vulnerable to SQL Injection via the 'addontype' parameter in versions up to, and including, 2.0.16. This is due to insufficient escaping on the user-supplied parameter and the lack of sufficient prep
- 7.5 High severity
Unlimited Elements For Elementor: Improper Limitation of a Pathname to a Restricted Directory
The Unlimited Elements for Elementor plugin for WordPress is vulnerable to Arbitrary File Read via the Repeater JSON/CSV URL parameter in versions up to, and including, 2.0.6. This is due to insufficient path traversal sanitization in the URLtoRelative() and u
- 7.2 High severity
Unlimited Elements For Elementor: Improper Neutralization of Input During Web Page Generation
The Unlimited Elements for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the form entry fields in all versions up to, and including, 2.0.5. This is due to insufficient input sanitization and output escaping on form submission
- 8.8 High severity
Doubly – Cross Domain Copy Paste for WordPress: Deserialization of Untrusted Data
The Doubly – Cross Domain Copy Paste for WordPress plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 1.0.46 via deserialization of untrusted input from the content.txt file within uploaded ZIP archives. This makes
- 7.2 High severity
Unlimited Elements for Elementor (Premium): Improper Neutralization of Input During Web Page Generation
The Unlimited Elements For Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up to, and including, 2.0 due to insufficient input sanitization and output escaping. This makes it possible for unauthe
- 8.8 High severity
Blox Page Builder: Unrestricted Upload of File with Dangerous Type
The Blox Page Builder plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the 'handleUploadFile' function in all versions up to, and including, 1.0.65. This makes it possible for authenticated attackers, with con
- 8.8 High severity
Unlimited Elements For Elementor: Improper Neutralization of Special Elements used in an SQL Command
The Unlimited Elements For Elementor (Free Widgets, Addons, Templates) plugin for WordPress is vulnerable to time-based SQL Injection via the ‘addons_order’ parameter in all versions up to, and including, 1.5.112 due to insufficient escaping on the user suppli
- 8.8 High severity
Unlimited Elements For Elementor: Improper Neutralization of Special Elements used in an SQL Command
The Unlimited Elements For Elementor (Free Widgets, Addons, Templates) plugin for WordPress is vulnerable to blind SQL Injection via the ‘data[addonID]’ parameter in all versions up to, and including, 1.5.109 due to insufficient escaping on the user supplied p
- 8.8 High severity
Unlimited Elements For Elementor: Improper Control of Generation of Code
The Unlimited Elements For Elementor (Free Widgets, Addons, Templates) plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1.5.89 via the template import functionality. This makes it possible for authenticated atta
- 8.8 High severity
Unlimited Elements For Elementor: Improper Neutralization of Special Elements used in an SQL Command
The Unlimited Elements For Elementor (Free Widgets, Addons, Templates) plugin for WordPress is vulnerable to SQL Injection via the ‘data[post_ids][0]’ parameter in all versions up to, and including, 1.5.107 due to insufficient escaping on the user supplied par
- 8.8 High severity
Unlimited Elements For Elementor: Improper Neutralization of Special Elements used in an SQL Command
The Unlimited Elements For Elementor (Free Widgets, Addons, Templates) plugin for WordPress is vulnerable to time-based SQL Injection via the ‘id’ parameter in all versions up to, and including, 1.5.102 due to insufficient escaping on the user supplied paramet
- 7.2 High severity
Unlimited Elements For Elementor: Improper Neutralization of Special Elements used in an OS Command
The Unlimited Elements For Elementor (Free Widgets, Addons, Templates) plugin for WordPress is vulnerable to command injection in all versions up to, and including, 1.5.102. This is due to insufficient filtering of template attributes during the creation of HT
- 8.8 High severity
Addon Library: Missing Authorization
The Addon Library plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the onAjaxAction function action in all versions up to, and including, 1.3.76. This makes it possible for authenticated attackers, with sub
- 7.2 High severity
Unlimited Addons for WPBakery Page Builder: Unrestricted Upload of File with Dangerous Type
The Unlimited Addons for WPBakery Page Builder plugin for WordPress is vulnerable to arbitrary file uploads due to insufficient file type validation on the 'importZipFile' function in versions up to, and including, 1.0.42. This makes it possible for authentica
- 8.8 High severity
Unlimited Elements For Elementor: Unrestricted Upload of File with Dangerous Type
The Unlimited Elements For Elementor (Free Widgets, Addons, Templates) for WordPress is vulnerable to arbitrary file uploads due to missing file type validation of files in the file manager functionality in versions up to, and including, 1.5.66 . This makes it