Login Request a demo
High severity · published May 25, 2026
CVE-2026-48837
WordPress Unlimited Elements For Elementor plugin <= 2.0.8 - SQL Injection vulnerability
8.5
CVSS
0.4%
EPSS
No
On KEV
Description
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Unlimited Elements For Elementor allows Blind SQL Injection. This issue affects Unlimited Elements For Elementor: from n/a through 2.0.8.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:L
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
High
Integrity
None
Availability
Low
Scope
Changed
Exploitation
Is it being used?
Exploit prediction (EPSS)0.4% · higher than 31% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
UE
Unlimited Elements For Elementor · Unlimited Elements
through 2.0.8 · source: vendor
Affected product
UE
Unlimited Elements For Elementor
Unlimited Elements
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-48837
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-48837
patchstack.com
https://patchstack.com/database/wordpress/plugin/unlimited-elements-for-elementor/vulnerability/wordpress-unlimited-elements-for-elementor-free-widgets-addons-templates-plugin-2-0-8-sql-injection-vulnerability?_s_id=cve
More from Unlimited Elements For Elementor
8.8
CVE-2023-31080
WordPress Unlimited Elements For Elementor plugin <= 1.5.65 - Multiple Broken Access Control vulnerability
8.8
CVE-2024-5329
Unlimited Elements For Elementor (Free Widgets, Addons, Templates) <= 1.5.109 - Authenticated (Contributor+) Blind SQL Injection via data[addonID] Parameter
8.8
CVE-2024-35674
WordPress Unlimited Elements For Elementor plugin <= 1.5.109 - Broken Access Control vulnerability
8.8
CVE-2023-6743
Unlimited Elements for Elementor <= 1.5.89 - Authenticated(Contributor+) Remote Code Execution via template import
8.8
CVE-2024-4779
Unlimited Elements for Elementor <= 1.5.107 - Authenticated (Contributor+) SQL Injection via data[post_ids][0]