CVE-2026-77150 in Unlimited Elements for Elementor Plugin
Summary
by MITRE • 09/11/2026
The Unlimited Elements For Elementor plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via 'data[name]' Parameter in all versions up to, and including, 2.0.16 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link. The show_preview AJAX action is registered for unauthenticated users and is gated only by a nonce, which an unauthenticated attacker can retrieve by loading any publicly accessible page that emits it.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 09/11/2026
The Unlimited Elements For Elementor plugin for WordPress contains a critical Reflected Cross-Site Scripting vulnerability affecting all versions up to 2.0.16. This security flaw stems from insufficient input sanitization and output escaping mechanisms within the application code, specifically targeting the data[name] parameter. The technical root cause lies in the improper handling of user-supplied input that is directly reflected back into the web page without adequate validation or encoding. When a malicious actor crafts a URL containing specially crafted JavaScript payloads within this parameter, the browser executes these scripts upon rendering the response. This type of vulnerability allows attackers to inject arbitrary client-side code into legitimate websites, which can be leveraged for various malicious purposes including session hijacking, credential theft, and defacement.
The operational impact of this vulnerability is significant due to its unauthenticated nature and ease of exploitation. The show_preview AJAX action associated with the plugin is registered in a manner that permits access by users who are not logged into the WordPress administration panel. While the endpoint is protected by a nonce for security purposes, this protection mechanism is fundamentally flawed because nonces generated on publicly accessible pages can be retrieved by any visitor without authentication. An attacker simply needs to load any page from the vulnerable site to extract the valid nonce and then use it in conjunction with their malicious payload within the data[name] parameter. This lowers the barrier for entry considerably, as no prior access or credentials are required to initiate an attack against a victim user who clicks on a crafted link.
From a classification perspective, this vulnerability aligns closely with CWE-79, which describes Improper Neutralization of Input During Web Page Generation commonly known as Cross-site Scripting. The specific vector is reflected XSS, where the malicious script is immediately returned by the web application in response to a user request rather than being stored on the server for later execution (Stored XSS). In terms of offensive security frameworks such as MITRE ATT&CK, this activity falls under T1059 Command and Scripting Interpretation via Web Browser. The attacker utilizes the browser environment to execute code, potentially leading further into techniques like T1078 Valid Accounts if session tokens are stolen or T1204 User Execution if social engineering is employed to trick users into clicking malicious links.
Mitigation strategies for this vulnerability involve both immediate patching and long-term security hardening practices. The primary remediation step is to upgrade the Unlimited Elements For Elementor plugin to a version newer than 2.0.16, where developers have presumably addressed the input sanitization and output escaping deficiencies. Administrators should also ensure that all other WordPress plugins are updated regularly to maintain overall site integrity. Additionally, implementing Content Security Policy headers can help mitigate the impact of successful XSS attacks by restricting the sources from which scripts can be loaded or executed. Regular security audits and code reviews focusing on how user input is processed before being rendered in HTML responses will further reduce the risk of similar vulnerabilities emerging in the future.