PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-77150 unitecms CVE debrief

The Unlimited Elements For Elementor plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'data[name]' parameter in all versions up to, and including, 2.0.16. This is due to insufficient input sanitization and output escaping. An unauthenticated attacker can inject arbitrary web scripts into pages that execute if they can trick a user into performing an action such as clicking on a link. The show_preview AJAX action is registered for unauthenticated users and is only gated by a nonce, which an unauthenticated attacker can retrieve by loading any publicly accessible page that emits it.

Vendor
unitecms
Product
Unlimited Elements For Elementor
CVSS
MEDIUM 6.1
CISA KEV
Not listed in stored evidence
Original CVE published
2026-09-11
Original CVE updated
2026-09-11
Advisory published
2026-09-11
Advisory updated
2026-09-11

Who should care

Defenders responsible for WordPress installations with the Unlimited Elements For Elementor plugin should assess exposure and prioritize patching or mitigation. This includes operators managing WordPress environments, vulnerability management teams, security teams, and IT personnel responsible for plugin updates and security configurations.

Why it matters

CVE-2026-77150 is a Reflected Cross-Site Scripting vulnerability in the Unlimited Elements For Elementor plugin for WordPress. Defenders should assess exposure, prioritize patching, and monitor for potential exploitation attempts.

  • Defenders must verify the presence of this vulnerability in their WordPress installations.
  • Successful exploitation could allow an attacker to inject arbitrary web scripts.
  • Defenders should prioritize patching or mitigating this vulnerability to prevent potential exploitation.
  • Further verification is required to determine the full scope of affected versions and potential impact.

Technical summary

The Unlimited Elements For Elementor plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'data[name]' parameter in all versions up to, and including, 2.0.16. This is due to insufficient input sanitization and output escaping. An unauthenticated attacker can inject arbitrary web scripts into pages that execute if they can trick a user into performing an action such as clicking on a link.

Defensive priority

Defenders should prioritize verifying the presence of this vulnerability in their WordPress installations and applying the necessary patches or mitigations.

Recommended defensive actions

  • Verify the presence of the Unlimited Elements For Elementor plugin in your WordPress installation
  • Check if the plugin version is 2.0.16 or earlier
  • Apply patches or mitigations provided by the vendor
  • Monitor for potential exploitation attempts
  • Review compensating controls for exposed systems while remediation is scheduled and verified
  • Track exceptions, retest remediated assets, and close the item only after evidence is documented
  • Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The CVE record and NVD entry provide details about the vulnerability, including its description, CVSS score, and references to source code. The Unlimited Elements For Elementor plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'data[name]' parameter in all versions up to, and including, 2.0.16 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into The CVE

Sources and references

Verified primary and authoritative sources

  • CVE-2026-77150 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-77150

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-77150 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-77150

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

  • Source reference

    Unverified legacy reference

    URL: https://plugins.trac.wordpress.org/browser/unlimited-elements-for-elementor/trunk/inc_php/framework/functions.php

    [email protected]

  • Source reference

    Unverified legacy reference

    URL: https://plugins.trac.wordpress.org/browser/unlimited-elements-for-elementor/trunk/inc_php/unitecreator_actions.class.php

    [email protected]

  • Source reference

    Unverified legacy reference

    URL: https://plugins.trac.wordpress.org/browser/unlimited-elements-for-elementor/trunk/inc_php/unitecreator_addon.class.php

    [email protected]

  • Source reference

    Unverified legacy reference

    URL: https://plugins.trac.wordpress.org/browser/unlimited-elements-for-elementor/trunk/inc_php/unitecreator_addons.class.php

    [email protected]

  • Source reference

    Unverified legacy reference

    URL: https://plugins.trac.wordpress.org/browser/unlimited-elements-for-elementor/trunk/inc_php/unitecreator_operations.class.php

    [email protected]

  • Source reference

    Unverified legacy reference

    URL: https://plugins.trac.wordpress.org/browser/unlimited-elements-for-elementor/trunk/provider/provider_admin.class.php

    [email protected]

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.