CVE-2026-105064 Unlimited Elements CVE debrief

Who should care

Defenders responsible for Elementor installations using Unlimited Elements For Elementor should assess potential exposure and impact. This includes operators, platform administrators, vulnerability management teams, and security teams who need to verify exposure and assess potential impact on Elementor installations using Unlimited Elements For Elementor.

Why it matters

CVE-2026-105064 is a Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection') vulnerability in Unlimited Elements For Elementor (Free Widgets, Addons, Templates). This issue allows Parameter Injection and affects versions from n/a through 2.0.22. Defenders should prioritize verifying exposure and assessing potential impact on Elementor installations using Unlimited Elements For Elementor.

• Verification of exposure is required to determine potential impact on Elementor installations.
• Defenders need to assess if Unlimited Elements For Elementor is installed and if the version is within the affected range.

Technical summary

The vulnerability allows Parameter Injection due to Unsafe Reflection in Unlimited Elements For Elementor (Free Widgets, Addons, Templates). This issue affects Unlimited Elements For Elementor (Free Widgets, Addons, Templates) versions from n/a through 2.0.22. The vulnerability is considered medium severity with a CVSS score of 6.5. Defenders should prioritize verifying exposure and assessing potential impact on Elementor installations using Unlimited Elements For Elementor. The CVE record and NVD entry provide primary source information.

Defensive priority

Defenders should prioritize verifying exposure and assessing potential impact on Elementor installations using Unlimited Elements For Elementor.

Recommended defensive actions

• Verify exposure by checking if Unlimited Elements For Elementor is installed and if the version is within the affected range.
• Assess potential impact on Elementor installations using Unlimited Elements For Elementor.
• Consider updating to a version outside the affected range if available.
• Review compensating controls for exposed systems while remediation is scheduled and verified.
• Check relevant monitoring, detection, and logs for exposed assets that need extra review.
• Track exceptions, retest remediated assets, and close the item only after evidence is documented.
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.

Evidence notes

The CVE record and NVD entry provide limited information about the vulnerability. Further verification is required to determine the actual impact and affected versions. The vulnerability allows Parameter Injection due to Unsafe Reflection in Unlimited Elements For Elementor (Free Widgets, Addons, Templates). The CVE record was published on 2026-10-05T09:17:11.140Z and has not been modified since then. The NVD entry and CVE Program record are the primary sources for this information.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.