Plugin security history

Unlimited Elements For Elementor Vulnerability History & Security Timeline

The Wordfence Intelligence dataset currently contains 37 vulnerability records associated with Unlimited Elements For Elementor, published between 2022 and 2026.

Dataset last synchronized: 2026-08-03 00:31:25 UTC

At a glance

Security Snapshot

37Total records

2Critical

13High

22Medium

0Low

0Informational

37Patched records

0Currently marked unpatched

2022-03-04First disclosure

2026-07-09Latest disclosure

37 of 37CVE coverage

Use this history

Check and watch Unlimited Elements For Elementor.

A history record does not establish whether the version installed on your website is affected. Enter the exact version in the checker, or add this software to a private Critical/High alert watchlist.

Check my installed version Watch Unlimited Elements For Elementor

Year-by-Year Timeline

Year	Records	Relative volume
2022	1	1 records
2023	6	6 records
2024	17	17 records
2025	5	5 records
2026	8	8 records

Severity Breakdown

Severity	Records	Share
Critical	2	5.4%
High	13	35.1%
Medium	22	59.5%

Vulnerability-Type Breakdown

Cross-Site Scripting

20 records54.1%

First: 2023. Latest: 2026.

SQL Injection

6 records16.2%

First: 2024. Latest: 2026.

Other

4 records10.8%

First: 2024. Latest: 2024.

Arbitrary File Upload

3 records8.1%

First: 2023. Latest: 2023.

Missing Authorization

2 records5.4%

First: 2022. Latest: 2023.

Information Disclosure

1 record2.7%

First: 2024. Latest: 2024.

Path Traversal

1 record2.7%

First: 2026. Latest: 2026.

Patch Status

Patched: 37
Currently marked unpatched: 0
Unknown status: 0

Patch status reflects the latest successfully synchronized source dataset and must be checked against the installed version.

Latest Known Patched Versions

2.0.13
2.0.11
2.0.9
2.0.8
2.0.7
2.0.6
2.0.2
2.0.1
1.5.149
1.5.143
1.5.141
1.5.136
1.5.127
1.5.122
1.5.113
1.5.110
1.5.108
1.5.91
1.5.105
1.5.103
1.5.97
1.5.94
1.5.75
1.5.66
1.5.67
1.5.61
1.5.49
1.5.3

Affected-Version History

Ranges are deduplicated by source range record and shown with the associated disclosure and known patched versions.

Affected range	Vulnerability	Published	Patched version	Severity
`*-2.0.12`	Unlimited Elements For Elementor <= 2.0.12 - Unauthenticated Stored Cross-Site Scripting	July 9, 2026	2.0.13	High
`*-2.0.10`	Unlimited Elements for Elementor <= 2.0.10 - Unauthenticated Stored Cross-Site Scripting	June 29, 2026	2.0.11	High
`*-2.0.8`	Unlimited Elements For Elementor <= 2.0.8 - Authenticated (Contributor+) SQL Injection	May 26, 2026	2.0.9	Medium
`*-2.0.7`	Unlimited Elements For Elementor <= 2.0.7 - Authenticated (Contributor+) SQL Injection via 'filter_search' Parameter	May 13, 2026	2.0.8	Medium
`*-1.5.140`	Freemius <= 2.10.1 - Reflected DOM-Based Cross-Site Scripting via url Parameter	April 30, 2026	1.5.141	Medium
`*-2.0.6`	Unlimited Elements For Elementor <= 2.0.6 - Authenticated (Contributor+) Arbitrary File Read via Path Traversal in Repeater JSON/CSV URL with Path Traversal	April 16, 2026	2.0.7	High
`*-2.0.5`	Unlimited Elements For Elementor <= 2.0.5 - Unauthenticated Stored Cross-Site Scripting via Form Entry Fields	March 9, 2026	2.0.6	High
`*-2.0.1`	Unlimited Elements for Elementor <= 2.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Border Hero Widget	February 2, 2026	2.0.2	Medium
`*-2.0`	Unlimited Elements For Elementor and Unlimited Elements For Elementor (Premium) <= 2.0 - Unauthenticated Stored Cross-Site Scripting via SVG File Upload	November 26, 2025	2.0.1	High
`*-1.5.148`	Unlimited Elements For Elementor <= 1.5.148 - Authenticated (Contributor+) Stored Cross-Site Scripting	August 27, 2025	1.5.149	Medium
`*-1.5.142`	Unlimited Elements For Elementor <= 1.5.142 - Authenticated (Contributor+) Stored Cross-Site Scripting	April 2, 2025	1.5.143	Medium
`*-1.5.140`	Unlimited Elements For Elementor (Free Widgets, Addons, Templates) <= 1.5.140 - Authenticated (Contributor+) Stored Cross-Site Scripting via Transparent Split Hero Widget	February 19, 2025	1.5.141	Medium
`*-1.5.135`	Unlimited Elements For Elementor (Free Widgets, Addons, Templates) <= 1.5.135 - Authenticated (Contributor+) Stored Cross-Site Scripting via Multiple Widgets	January 8, 2025	1.5.136	Medium
`*-1.5.126`	Unlimited Elements For Elementor (Free Widgets, Addons, Templates) <= 1.5.126 - Authenticated (Contributor+) Stored Cross-Site Scripting	December 11, 2024	1.5.127	Medium
`*-1.5.121`	Unlimited Elements For Elementor (Free Widgets, Addons, Templates) <= 1.5.121 - Authenticated (Editor+) Remote Code Execution	October 14, 2024	1.5.122	High
`*-1.5.121`	Unlimited Elements For Elementor (Free Widgets, Addons, Templates) <= 1.5.121 - Reflected Cross-Site Scripting	September 30, 2024	1.5.122	Medium
`*-1.5.112`	Unlimited Elements For Elementor (Free Widgets, Addons, Templates) <= 1.5.112 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'username'	July 8, 2024	1.5.113	Medium
`*-1.5.112`	Unlimited Elements For Elementor (Free Widgets, Addons, Templates) <= 1.5.112 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'email'	July 8, 2024	1.5.113	Medium
`*-1.5.112`	Unlimited Elements For Elementor (Free Widgets, Addons, Templates) <= 1.5.112 - Authenticated (Contributor+) Time-Based SQL Injection	July 8, 2024	1.5.113	High
`*-1.5.112`	Unlimited Elements For Elementor (Free Widgets, Addons, Templates) <= 1.5.112 - IP Address Spoofing to Antispam Bypass	July 8, 2024	1.5.113	Medium
`*-1.5.109`	Unlimited Elements For Elementor (Free Widgets, Addons, Templates) <= 1.5.109 - Authenticated (Contributor+) Blind SQL Injection via data[addonID] Parameter	June 5, 2024	1.5.110	High
`*-1.5.109`	Unlimited Elements For Elementor (Free Widgets, Addons, Templates) <= 1.5.109 - Authenticated (Contributor+) Information Exposure	June 5, 2024	1.5.110	Medium
`*-1.5.107`	Unlimited Elements For Elementor (Free Widgets, Addons, Templates) <= 1.5.107 - Authenticated (Contributor+) Stored Cross-Site Scripting via Text Field	May 29, 2024	1.5.108	Medium
`*-1.5.89`	Unlimited Elements for Elementor <= 1.5.89 - Authenticated(Contributor+) Remote Code Execution via template import	May 28, 2024	1.5.91	High
`*-1.5.107`	Unlimited Elements for Elementor <= 1.5.107 - Authenticated (Contributor+) SQL Injection via data[post_ids][0]	May 22, 2024	1.5.108	High

Selected source records

Latest Records

HighCVE-2026-57718

Unlimited Elements For Elementor <= 2.0.12 - Unauthenticated Stored Cross-Site Scripting

Published: July 9, 2026

Affected versions: *-2.0.12
Patched versions: 2.0.13

Original Wordfence record

HighCVE-2026-10081

Unlimited Elements for Elementor <= 2.0.10 - Unauthenticated Stored Cross-Site Scripting

Published: June 29, 2026

Affected versions: *-2.0.10
Patched versions: 2.0.11

Original Wordfence record

MediumCVE-2026-48837

Unlimited Elements For Elementor <= 2.0.8 - Authenticated (Contributor+) SQL Injection

Published: May 26, 2026

Affected versions: *-2.0.8
Patched versions: 2.0.9

Original Wordfence record

MediumCVE-2026-5486

Unlimited Elements For Elementor <= 2.0.7 - Authenticated (Contributor+) SQL Injection via 'filter_search' Parameter

Published: May 13, 2026

Affected versions: *-2.0.7
Patched versions: 2.0.8

Original Wordfence record

MediumCVE-2024-13362

Freemius <= 2.10.1 - Reflected DOM-Based Cross-Site Scripting via url Parameter

Published: April 30, 2026

Affected versions: *-3.4.12
Patched versions: 3.4.15

Affected versions: *-2.2.2
Patched versions: 2.2.5

Affected versions: *-3.0.5
Patched versions: 3.0.7

Affected versions: *-2.3.1
Patched versions: 2.3.2

Affected versions: *-2.0.2
Patched versions: 2.0.3

Affected versions: *-1.3.4
Patched versions: Not supplied

Affected versions: *-1.2.7
Patched versions: 1.2.8

Affected versions: *-1.3.1
Patched versions: 1.3.5

Affected versions: *-2.9.2
Patched versions: 2.10.0

Affected versions: *-2.6.7
Patched versions: 2.7.0

Affected versions: *-4.6.8
Patched versions: 4.7.6

Affected versions: *-1.9.2
Patched versions: 1.9.3

Affected versions: *-1.6.22
Patched versions: 1.6.23

Affected versions: *-1.4.2
Patched versions: 1.4.3

Affected versions: *-2.1
Patched versions: 2.2

Affected versions: *-2.6.5
Patched versions: 2.6.7

Affected versions: *-2.2.27
Patched versions: 2.5.1

Affected versions: *-3.2.6
Patched versions: 3.2.8

Affected versions: *-5.17.2
Patched versions: 5.19.0

Affected versions: *-1.1.16
Patched versions: 1.1.17

Affected versions: *-2.5.8
Patched versions: 2.6.1

Affected versions: *-1.1.3
Patched versions: 1.1.10

Affected versions: *-2.5.5
Patched versions: 2.5.6

Affected versions: *-4.2.0
Patched versions: 4.2.1

Affected versions: *-3.0.2
Patched versions: 3.0.3

Affected versions: *-1.5.5
Patched versions: 1.6

Affected versions: *-1.2.56
Patched versions: 1.2.57

Affected versions: *-3.2.4
Patched versions: 3.2.5

Affected versions: *-2.4.1
Patched versions: 2.4.4

Affected versions: *-1.4.0
Patched versions: 1.4.1

Affected versions: *-1.6.3
Patched versions: 1.6.4

Affected versions: *-1.5.140
Patched versions: 1.5.141

Affected versions: *-2.6.0
Patched versions: 2.6.1

Affected versions: *-2.3.4
Patched versions: 2.3.5

Affected versions: *-2.5.7
Patched versions: 2.5.9

Affected versions: *-3.2.6
Patched versions: 3.2.9

Affected versions: *-1.7
Patched versions: Not supplied

Affected versions: *-2.1.6
Patched versions: 2.2.0

Affected versions: *-1.5.10
Patched versions: 1.6.2

Affected versions: *-2.0.7.2
Patched versions: 2.0.7.3

Affected versions: *-2.4.27
Patched versions: 2.4.29

Affected versions: *-3.12.1
Patched versions: 3.13.1

Affected versions: *-6.0.2
Patched versions: Not supplied

Affected versions: *-5.222
Patched versions: 5.225

Affected versions: *-1.1.5
Patched versions: 1.1.6

Affected versions: *-1.9.0
Patched versions: 1.10.0

Affected versions: *-1.4.7
Patched versions: Not supplied

Affected versions: *-1.4.9
Patched versions: 1.5.0

Affected versions: *-3.5.1
Patched versions: 3.5.2

Affected versions: *-2.16.3.3
Patched versions: 2.16.3.6

Affected versions: *-1.7.2
Patched versions: 1.8.5

Affected versions: *-5.0.57
Patched versions: 5.1.8

Affected versions: *-1.8.99
Patched versions: 2.3.17

Affected versions: *-3.0.0
Patched versions: 3.1.0

Affected versions: *-3.4.9
Patched versions: 3.4.11

Affected versions: *-2.1.34
Patched versions: 2.1.35

Affected versions: *-1.1.13
Patched versions: 1.1.17

Affected versions: *-1.7
Patched versions: Not supplied

Affected versions: *-5.5.8
Patched versions: 5.5.9

Affected versions: *-1.9.4
Patched versions: 1.9.7

Affected versions: *-1.10.4
Patched versions: 1.10.5.1

Affected versions: *-6.1.13
Patched versions: 6.1.14

Affected versions: *-2.9.7
Patched versions: 2.10.0

Affected versions: *-2.2.38
Patched versions: 2.2.39

Affected versions: *-3.12
Patched versions: 3.13

Affected versions: *-2.2.0
Patched versions: 2.3.1

Affected versions: *-2.3.7
Patched versions: 2.3.12

Affected versions: *-3.2.8
Patched versions: 3.2.9

Affected versions: *-2.3.0
Patched versions: 2.3.1

Affected versions: *-2.6.0
Patched versions: 2.10.0

Affected versions: *-2.07
Patched versions: 2.08

Affected versions: *-6.6.5
Patched versions: 6.6.6

Affected versions: *-3.9.6
Patched versions: 3.9.7

Affected versions: *-2.0.82
Patched versions: 2.0.83

Affected versions: *-3.3.2
Patched versions: 3.3.4

Affected versions: *-3.2.7
Patched versions: 3.2.9

Affected versions: *-3.2.4.4
Patched versions: 3.2.4.5

Affected versions: *-2.1.0
Patched versions: 2.2.0

Affected versions: *-1.7.0
Patched versions: 1.7.1

Affected versions: *-1.7.0
Patched versions: 1.7.1

Affected versions: *-2.5.9
Patched versions: 2.5.17

Affected versions: *-2.8.6
Patched versions: 2.8.7

Affected versions: *-1.6.3.2
Patched versions: 1.6.3.3

Affected versions: *-7.3.3
Patched versions: 7.3.4

Affected versions: *-1.0.40
Patched versions: 1.0.41

Affected versions: *-1.10.6
Patched versions: 1.10.8

Affected versions: *-2.4.2
Patched versions: 2.4.4

Affected versions: *-3.3.0
Patched versions: 3.3.2

Affected versions: *-3.3.7
Patched versions: 3.3.8

Affected versions: *-2.25.16
Patched versions: 2.25.19

Affected versions: *-2.0.0
Patched versions: 2.0.1

Affected versions: *-1.13.15
Patched versions: 1.13.16

Affected versions: *-1.6.0
Patched versions: 1.6.1

Affected versions: *-3.0.6
Patched versions: 3.0.7

Affected versions: *-3.2.2
Patched versions: 3.2.3

Affected versions: *-1.5.8
Patched versions: Not supplied

Affected versions: *-5.3.4
Patched versions: 5.4.0

Affected versions: *-3.8.3
Patched versions: 3.8.4

Affected versions: *-1.2.7
Patched versions: 1.2.9

Affected versions: *-2.7.33
Patched versions: 2.7.34

Affected versions: *-5.5.31
Patched versions: 5.5.32

Affected versions: *-2.5.9
Patched versions: 2.6.0

Affected versions: *-2.4.1
Patched versions: 2.4.3

Affected versions: *-4.4.1
Patched versions: 4.4.2

Affected versions: *-1.8.5
Patched versions: 1.9

Affected versions: *-1.16.3
Patched versions: 1.16.4

Affected versions: *-1.3.3
Patched versions: 1.3.4

Affected versions: *-2.3.11
Patched versions: Not supplied

Affected versions: *-1.8.4.8.1
Patched versions: 1.8.4.9.1

Affected versions: *-3.1.28
Patched versions: 3.2.2

Affected versions: *-8.0.7
Patched versions: 8.0.8

Affected versions: *-2.1.5
Patched versions: Not supplied

Affected versions: *-1.6.0
Patched versions: 1.6.5

Affected versions: *-1.9.8
Patched versions: 2.0.19

Affected versions: *-1.2.6
Patched versions: Not supplied

Affected versions: *-4.5.0
Patched versions: 4.5.1

Affected versions: *-1.0.4
Patched versions: 1.1

Affected versions: *-1.7.34
Patched versions: 1.8.12

Affected versions: *-6.1.10
Patched versions: 6.1.11

Affected versions: *-2.8.4
Patched versions: Not supplied

Affected versions: *-3.1.26
Patched versions: 3.1.28

Affected versions: *-3.12.0
Patched versions: 3.16.0

Affected versions: *-2.24.6
Patched versions: 2.25.2

Affected versions: *-7.7.0
Patched versions: 7.7.3

Affected versions: *-2.7.0
Patched versions: 2.7.7

Affected versions: *-3.7.3
Patched versions: Not supplied

Affected versions: *-3.2.7
Patched versions: 3.2.9

Affected versions: *-1.6.3
Patched versions: 1.6.6

Affected versions: *-1.9.0
Patched versions: 1.21.0

Affected versions: *-1.6.6
Patched versions: 1.7.5

Affected versions: *-1.5.8
Patched versions: 1.6.1

Original Wordfence record

HighCVE-2026-4659

Unlimited Elements For Elementor <= 2.0.6 - Authenticated (Contributor+) Arbitrary File Read via Path Traversal in Repeater JSON/CSV URL with Path Traversal

Published: April 16, 2026

Affected versions: *-2.0.6
Patched versions: 2.0.7

Original Wordfence record

HighCVE-2026-2724

Unlimited Elements For Elementor <= 2.0.5 - Unauthenticated Stored Cross-Site Scripting via Form Entry Fields

Published: March 9, 2026

Affected versions: *-2.0.5
Patched versions: 2.0.6

Original Wordfence record

MediumCVE-2025-14274

Unlimited Elements for Elementor <= 2.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Border Hero Widget

Published: February 2, 2026

Affected versions: *-2.0.1
Patched versions: 2.0.2

Original Wordfence record

Highest-Severity Records

CriticalCVE-2023-31090

Unlimited Elements For Elementor (Free Widgets, Addons, Templates) <= 1.5.60 - Arbitrary File Upload in File Manager

Published: May 22, 2023

Affected versions: *-1.5.60
Patched versions: 1.5.61

Original Wordfence record

CriticalCVE-2023-33930

Unlimited Elements For Elementor (Free Widgets, Addons, Templates) <= 1.5.66 - Zip Extraction to Arbitrary File Upload in File Manager

Published: May 22, 2023

Affected versions: *-1.5.66
Patched versions: 1.5.67

Original Wordfence record

HighCVE-2023-6743

Unlimited Elements for Elementor <= 1.5.89 - Authenticated(Contributor+) Remote Code Execution via template import

Published: May 28, 2024

Affected versions: *-1.5.89
Patched versions: 1.5.91

Original Wordfence record

HighCVE-2024-6166

Unlimited Elements For Elementor (Free Widgets, Addons, Templates) <= 1.5.112 - Authenticated (Contributor+) Time-Based SQL Injection

Published: July 8, 2024

Affected versions: *-1.5.112
Patched versions: 1.5.113

Original Wordfence record

HighCVE-2024-4779

Unlimited Elements for Elementor <= 1.5.107 - Authenticated (Contributor+) SQL Injection via data[post_ids][0]

Published: May 22, 2024

Affected versions: *-1.5.107
Patched versions: 1.5.108

Original Wordfence record

HighCVE-2023-3295

Unlimited Elements For Elementor (Free Widgets, Addons, Templates) <= 1.5.66 - Authenticated (Contributor+) Arbitrary File Upload

Published: June 16, 2023

Affected versions: *-1.5.66
Patched versions: 1.5.67

Original Wordfence record

HighCVE-2024-3055

Unlimited Elements For Elementor (Free Widgets, Addons, Templates) <= 1.5.102 - Authenticated (Contributor+) SQL Injection

Published: May 10, 2024

Affected versions: *-1.5.102
Patched versions: 1.5.105

Original Wordfence record

HighCVE-2024-5329

Unlimited Elements For Elementor (Free Widgets, Addons, Templates) <= 1.5.109 - Authenticated (Contributor+) Blind SQL Injection via data[addonID] Parameter

Published: June 5, 2024

Affected versions: *-1.5.109
Patched versions: 1.5.110

Original Wordfence record

View all associated vulnerabilities

Need help reviewing an exposed WordPress website?

Running an affected version does not prove that a website was compromised. Suspicious redirects, unknown administrators, injected content, unexpected files or recurring malware may require a manual investigation.

WordPress Malware Removal WordPress Security Maintenance Contact 3Zero Digital

Vulnerability data: Wordfence Intelligence. Analysis and practical guidance: 3Zero Digital.

Data Source, Attribution and Methodology

This page aggregates active Production Feed records. Counts are not software-quality rankings, and an affected version does not prove exploitation or infection. Read the full methodology.

Return to the Security History Directory