CVE-2026-116558 in Unlimited Elements for Elementor Plugin
Summary
by MITRE • 11/07/2026
The Unlimited Elements for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the '<title>/<description> inside the attacker-controlled RSS feed body' parameter in all versions up to, and including, 2.0.26 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This is exploitable against any site whose administrator has placed the RSS Feed catalog widget pointing at a feed URL the attacker controls, as the plugin's own 2.0.25 escaping pre-processor intentionally excludes |raw prints in element content positions from its escaping logic, and XML entity-encoded payloads in feed item titles are decoded back to raw markup before reaching the sink.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 11/07/2026
The Unlimited Elements for Elementor plugin for WordPress contains a critical stored cross-site scripting vulnerability affecting all versions up to and including 2.0.26. This flaw stems from insufficient input sanitization and output escaping mechanisms within the RSS Feed catalog widget functionality. The specific attack vector involves manipulating the title or description fields inside an attacker-controlled RSS feed body. Because this data is processed by the plugin without adequate validation, it allows for the injection of arbitrary web scripts that persist in the system until remediated.
The technical root cause lies in a deliberate design choice within version 2.0.25 where the escaping pre-processor intentionally excludes raw prints in element content positions from its standard escaping logic. This exception creates a pathway for malicious payloads to bypass security controls. When an RSS feed item contains XML entity-encoded payloads, such as encoded script tags or event handlers, these are decoded back into raw markup before reaching the rendering sink. Consequently, when the page loads, the browser interprets this content as executable code rather than plain text, leading to direct execution of attacker-supplied scripts within the context of the victim site.
Operationally, this vulnerability poses a severe risk because it is exploitable by unauthenticated attackers against any WordPress site that utilizes the RSS Feed catalog widget pointing at an external feed URL controlled by the adversary. The impact extends beyond simple defacement; successful exploitation enables session hijacking, credential theft via keylogging or cookie stealing, and potentially full account takeover if administrative privileges are targeted. Since the payload is stored within the plugin's rendering logic, every user who views a page containing the compromised widget will trigger the malicious script execution without requiring further interaction from the attacker beyond initial feed configuration.
This vulnerability aligns with CWE-79, which classifies improper neutralization of input during web page generation as cross-site scripting. From an offensive security perspective, it maps to MITRE ATT&CK technique T1059.007, specifically JavaScript execution within a browser environment. The attack chain involves initial access through the feed source configuration and persistence via the stored nature of the XSS payload in the rendered output.
Mitigation strategies must prioritize immediate patching by upgrading the Unlimited Elements for Elementor plugin to version 2.0.27 or later, where these escaping exclusions have been addressed. In environments where an upgrade is not immediately feasible, administrators should restrict access to RSS feed sources to trusted and verified URLs only, avoiding any input from untrusted third-party feeds. Additionally, implementing a Content Security Policy with strict script-src directives can help mitigate the impact of such injections by preventing unauthorized script execution in the browser context. Regular security audits of plugin configurations and continuous monitoring for unusual outbound requests or DOM manipulations are also recommended to detect potential exploitation attempts early.