CVE-2026-92923

MEDIUMCVSS 6.3

Description

The Unlimited Elements for Elementor WordPress plugin before 2.0.21 does not sanitise and escape a parameter before using it in a SQL statement, allowing users with a role as low as subscriber to perform blind SQL injection attacks and read arbitrary data from the database. Version 2.0.18 removed the subscriber-level access, so from 2.0.18 onward the issue requires a Contributor role or above.

Timeline

Published:October 3rd, 2026 6:16 AM

Last modified:October 3rd, 2026 4:16 PM

CVSS Scoring

CVSS v3: 6.3 (MEDIUM)

CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:N/A:N

Weaknesses (CWE)

CWE-89

References & Reports

Advisories, patches, and third-party reports

https://wpscan.com/vulnerability/1d02096b-81c4-421b-a7d3-b0ed7b1d173b/

Source: NIST NVD · Data may lag official sources by up to one minute