CVE-2026-85016
The Unlimited Elements for Elementor WordPress plugin before 2.0.21 does not escape an icon value…
- Risk score
- 44/100
- CVSS
- 6.8 v3.1
- Exploit chance (30 days)
- 0.2%
- Published
- 2 Oct 2026
Open in the live forecast Today's forecast
What to know
- What it is
- The Unlimited Elements for Elementor WordPress plugin before 2.0.21 does not escape an icon value before concatenating it into an HTML attribute in its shared widget-parameter processor, allowing users with Contributor access (who do not hold unfiltered_html) to store a payload that executes when the page is rendered.
- Affected
- See advisory
- Fix
- Upgrade the product to 2.0.21 or later.
- Exploitation
- No known exploitation
Why it is Yellow
- CVSS 6.8 medium
References
Original description
The Unlimited Elements for Elementor WordPress plugin before 2.0.21 does not escape an icon value before concatenating it into an HTML attribute in its shared widget-parameter processor, allowing users with Contributor access (who do not hold unfiltered_html) to store a payload that executes when the page is rendered.
Last activity 2 Oct 2026. Patch Forecast updates every hour.