Unlimited Elements For Elementor vulnerabilities
12 known vulnerabilities in Unlimited Elements For Elementor from Unitecms. 12 are rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.
Latest first
- 7.2 High severity
Unlimited Elements for Elementor: Improper Neutralization of Input During Web Page Generation
The Unlimited Elements for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the '<title>/<description> inside the attacker-controlled RSS feed body' parameter in all versions up to, and including, 2.0.26 due to insufficient input
- 7.5 High severity
Unlimited Elements For Elementor: Improper Neutralization of Special Elements used in an SQL Command
The Unlimited Elements For Elementor plugin for WordPress is vulnerable to SQL Injection via the 'addontype' parameter in versions up to, and including, 2.0.16. This is due to insufficient escaping on the user-supplied parameter and the lack of sufficient prep
- 7.5 High severity
Unlimited Elements For Elementor: Improper Limitation of a Pathname to a Restricted Directory
The Unlimited Elements for Elementor plugin for WordPress is vulnerable to Arbitrary File Read via the Repeater JSON/CSV URL parameter in versions up to, and including, 2.0.6. This is due to insufficient path traversal sanitization in the URLtoRelative() and u
- 7.2 High severity
Unlimited Elements For Elementor: Improper Neutralization of Input During Web Page Generation
The Unlimited Elements for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the form entry fields in all versions up to, and including, 2.0.5. This is due to insufficient input sanitization and output escaping on form submission
- 7.2 High severity
Unlimited Elements for Elementor (Premium): Improper Neutralization of Input During Web Page Generation
The Unlimited Elements For Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up to, and including, 2.0 due to insufficient input sanitization and output escaping. This makes it possible for unauthe
- 8.8 High severity
Unlimited Elements For Elementor: Improper Neutralization of Special Elements used in an SQL Command
The Unlimited Elements For Elementor (Free Widgets, Addons, Templates) plugin for WordPress is vulnerable to time-based SQL Injection via the ‘addons_order’ parameter in all versions up to, and including, 1.5.112 due to insufficient escaping on the user suppli
- 8.8 High severity
Unlimited Elements For Elementor: Improper Neutralization of Special Elements used in an SQL Command
The Unlimited Elements For Elementor (Free Widgets, Addons, Templates) plugin for WordPress is vulnerable to blind SQL Injection via the ‘data[addonID]’ parameter in all versions up to, and including, 1.5.109 due to insufficient escaping on the user supplied p
- 8.8 High severity
Unlimited Elements For Elementor: Improper Control of Generation of Code
The Unlimited Elements For Elementor (Free Widgets, Addons, Templates) plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1.5.89 via the template import functionality. This makes it possible for authenticated atta
- 8.8 High severity
Unlimited Elements For Elementor: Improper Neutralization of Special Elements used in an SQL Command
The Unlimited Elements For Elementor (Free Widgets, Addons, Templates) plugin for WordPress is vulnerable to SQL Injection via the ‘data[post_ids][0]’ parameter in all versions up to, and including, 1.5.107 due to insufficient escaping on the user supplied par
- 8.8 High severity
Unlimited Elements For Elementor: Improper Neutralization of Special Elements used in an SQL Command
The Unlimited Elements For Elementor (Free Widgets, Addons, Templates) plugin for WordPress is vulnerable to time-based SQL Injection via the ‘id’ parameter in all versions up to, and including, 1.5.102 due to insufficient escaping on the user supplied paramet
- 7.2 High severity
Unlimited Elements For Elementor: Improper Neutralization of Special Elements used in an OS Command
The Unlimited Elements For Elementor (Free Widgets, Addons, Templates) plugin for WordPress is vulnerable to command injection in all versions up to, and including, 1.5.102. This is due to insufficient filtering of template attributes during the creation of HT
- 8.8 High severity
Unlimited Elements For Elementor: Unrestricted Upload of File with Dangerous Type
The Unlimited Elements For Elementor (Free Widgets, Addons, Templates) for WordPress is vulnerable to arbitrary file uploads due to missing file type validation of files in the file manager functionality in versions up to, and including, 1.5.66 . This makes it