PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-75586 unitecms CVE debrief

The Unlimited Elements For Elementor plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'formData[id]' parameter in all versions up to, and including, 2.0.17. This is due to insufficient input sanitization and output escaping. An unauthenticated attacker can inject arbitrary web scripts into pages that execute if they can trick a user into performing an action such as clicking on a link.

Vendor
unitecms
Product
Unlimited Elements For Elementor
CVSS
MEDIUM 6.1
CISA KEV
Not listed in stored evidence
Original CVE published
2026-09-05
Original CVE updated
2026-09-07
Advisory published
2026-09-05
Advisory updated
2026-09-07

Who should care

WordPress administrators, security teams, and users of the Unlimited Elements For Elementor plugin should be aware of this vulnerability and take steps to verify exposure and mitigate potential risks.

Why it matters

CVE-2026-75586 is a Reflected Cross-Site Scripting vulnerability in the Unlimited Elements For Elementor plugin for WordPress. Defenders should prioritize verifying exposure, especially for publicly accessible pages, and consider updating to a patched version or applying mitigations.

  • An attacker could inject arbitrary web scripts into pages that execute if they can trick a user into performing an action such as clicking on a link.
  • Successful exploitation could lead to unauthorized script execution in the context of the user's browser.
  • Defenders should verify the presence of this vulnerability in their WordPress installations and assess exposure.
  • Remediation priority follows from verifying the presence of affected versions and applying patches or mitigations.

Technical summary

The Unlimited Elements For Elementor plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'formData[id]' parameter in all versions up to, and including, 2.0.17. The front-end AJAX handler is registered on the public 'wp' action with no nonce, capability, or referer check, and the raw attacker-controlled id value is interpolated verbatim into an exception message that is echoed back without escaping.

Defensive priority

Defenders should prioritize verifying the presence of this vulnerability in their WordPress installations and assess exposure, especially for publicly accessible pages using the affected plugin.

Recommended defensive actions

  • Verify the presence of the Unlimited Elements For Elementor plugin in your WordPress installation and check if the version is 2.0.17 or earlier.
  • Assess exposure, especially for publicly accessible pages using the affected plugin.
  • Consider updating to a patched version of the plugin if available.
  • Monitor for suspicious activity or anomalies in your WordPress installation.
  • Review compensating controls for exposed systems while remediation is scheduled and verified.
  • Check relevant monitoring, detection, and logs for exposed assets that need extra review.
  • Track exceptions, retest remediated assets, and close the item only after evidence is documented.

Evidence notes

The CVE record and NVD entry provide details on the vulnerability, including its description, CVSS score, and affected versions. However, specific details about exploitation or victim impact are not provided.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-75586 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-75586

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-75586 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-75586

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

  • Source reference

    Unverified legacy reference

    URL: https://plugins.trac.wordpress.org/browser/unlimited-elements-for-elementor/trunk/inc_php/framework/helper_base.class.php

    [email protected]

  • Source reference

    Unverified legacy reference

    URL: https://plugins.trac.wordpress.org/browser/unlimited-elements-for-elementor/trunk/inc_php/unitecreator_filters_process.class.php

    [email protected]

  • Source reference

    Unverified legacy reference

    URL: https://plugins.trac.wordpress.org/browser/unlimited-elements-for-elementor/trunk/inc_php/unitecreator_form.class.php

    [email protected]

  • Source reference

    Unverified legacy reference

    URL: https://plugins.trac.wordpress.org/browser/unlimited-elements-for-elementor/trunk/provider/core/unlimited_elements/helper_provider_core.class.php

    [email protected]

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.