CVE-2026-75586

The Unlimited Elements For Elementor plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via 'formData[id]' Parameter in all versions up to, and including, 2.0.17 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link. The front-end AJAX handler is registered on the public 'wp' action with no nonce, capability, or referer check, and the raw attacker-controlled id value is interpolated verbatim into an exception message that is echoed back without escaping; when the response is served as text/html rather than application/json, the browser parses the injected markup.

• CWE-79

• https://plugins.trac.wordpress.org/browser/unlimited-elements-for-elementor/trunk/inc_php/framework/helper_base.class.php#L44
• https://plugins.trac.wordpress.org/browser/unlimited-elements-for-elementor/trunk/inc_php/unitecreator_filters_process.class.php#L4083
• https://plugins.trac.wordpress.org/browser/unlimited-elements-for-elementor/trunk/inc_php/unitecreator_form.class.php#L1159
• https://plugins.trac.wordpress.org/browser/unlimited-elements-for-elementor/trunk/inc_php/unitecreator_form.class.php#L179
• https://plugins.trac.wordpress.org/browser/unlimited-elements-for-elementor/trunk/provider/core/unlimited_elements/helper_provider_core.class.php#L746
• https://www.wordfence.com/threat-intel/vulnerabilities/id/522bdd65-8077-4cd4-800a-e6ef9a982d33?source=cve

Published

Sep 5, 2026

Last Modified

Sep 8, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-7557An improper verification of cryptographic signature vulnerab…9.1
• CVE-2026-75573In MongoDB Connector for BI, mongodrdl may write a TLS priva…4.4
• CVE-2026-75574The Grav Email plugin (getgrav/grav-plugin-email) before 4.2…8.8
• CVE-2026-75575Rocket.Chat exposes the sendForgotPasswordEmail Meteor metho…5.3
• CVE-2026-7558The Age Verification & Identity Verification by Token of Tru…5.3
• CVE-2026-75583keeper.sh's calendar module version prior to 2.18.14 contain…3.5
• CVE-2026-75587Mattermost Desktop App versions <=6.2 6.2.2.0 fail to redact…3.3
• CVE-2026-75589Net::OAuth versions before 0.33 for Perl check HMAC-SHA1, HM…7.5
• CVE-2026-7559The Affilia – Affiliate Program & Referral Tracking for Word…4.3
• CVE-2026-75592Kirby is an open-source content management system. Prior to …6.9
• CVE-2026-75593BuildKit is a toolkit for converting source code to build ar…7.2
• CVE-2026-75594Kirby is an open-source content management system. Prior to …8.2