Unlimited Elements For Elementor: Blind SQL injection
Summary
The WordPress plugin Unlimited Elements For Elementor (Free Widgets, Addons, Templates) up to and including version 2.0.20 contains a blind SQL injection flaw (CWE-89). An attacker with a low-privilege account on the WordPress site could use it to read, modify or delete data in the site database, including user accounts. Patchstack rates the issue as low priority and unlikely to be exploited, but the CVSS score is 8.5 and the impact on the database is high.
Affected
- Unlimited Elements For Elementor (Free Widgets, Addons, Templates), WordPress plugin, versions n/a through 2.0.20
- The start of the version range is not stated, so earlier versions are presumably affected but this is unconfirmed.
Fixed in
- Version 2.0.21 (Patchstack patched version)
- Patchstack advises updating to version 2.0.21 or later. Newer releases exist for other issues in this plugin, so install the latest release from WordPress.org. The current version number could not be verified with the vendor.
Workaround
- No vendor-documented workaround. Patchstack recommends updating. If this is not possible, ask the hosting provider or web developer for help.
Exploitation
- No evidence of exploitation in the wild found for this CVE.
- No public proof of concept found for this CVE ID.
- Patchstack assesses the issue as low priority and unlikely to be exploited. CISA SSVC lists exploitation as none and automatable as no.
- The plugin has other SQL injection CVEs, some reachable by unauthenticated users.
- Privilege required: CVSS 3.1 vector specifies low privileges (PR:L), while Patchstack lists Developer. The sources conflict, so assume any logged-in account could be sufficient.
Our recommendation
- Update the plugin to the latest version from WordPress.org and confirm the installed version.
- Review user accounts and disable open registration if not needed.
- Check the database for signs of tampering if an older version was exposed.
- Monitor for unusual database errors or changes.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Patchstack: SQL injection advisory for Unlimited Elements For Elementor patchstack.com
- Strix: CVE-2026-103338 (mirror of CNA data) www.strix.ai
- WPScan: Unlimited Elements For Elementor plugin wpscan.com
- WPScan: CVE-2026-92923 blind SQL injection wpscan.com
- VulDB: CVE-2026-103355 (possible duplicate) vuldb.com
- EUVD-2026-103338 (different vulnerability, do not confuse) vulners.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 11:37.
Original description (NVD)
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Unlimited Elements Unlimited Elements For Elementor (Free Widgets, Addons, Templates) unlimited-elements-for-elementor allows Blind SQL Injection.This issue affects Unlimited Elements For Elementor (Free Widgets, Addons, Templates): from n/a through 2.0.20.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.