Unlimited Elements For Elementor (Free Widgets, Addons, Templates) plugin cross-site scripting flaw

Malicious scripts can be planted through a WordPress widget plugin.

Summary

A reflected cross-site scripting flaw in the Unlimited Elements For Elementor WordPress plugin. WordPress sites running version 2.0.26 or earlier are affected.

What to do

Update to version 2.0.27 or later.

Products and platforms

Unlimited Elements For Elementor (Free Widgets, Addons, Templates)

CVE IDs

CVE-2026-62007 (opens in a new tab)

Sources

CVE record: cve.org (opens in a new tab)

Times

First published 2026-11-04 08:00 UTC

First seen 2026-11-09 15:20 UTC