6.5Medium

CVE-2026-28146WordPress Unlimited Elements For Elementor (Free Widgets, Addons, Templates) plugin <= 2.0.14 - Arbitrary File Download vulnerability

Unlimited Elements Unlimited Elements For Elementor (Free Widgets, Addons, Templates) Published: 2026-08-06 17:27 (3 months ago)

Description

Contributor Arbitrary File Download in Unlimited Elements For Elementor (Free Widgets, Addons, Templates) <= 2.0.14 versions.

Weakness (CWE): CWE-22

Data: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Published as the sources state it, in English.

Affected products and versions

Vendor	Product	Versions
Unlimited Elements	Unlimited Elements For Elementor (Free Widgets, Addons, Templates)	≤ 2.0.14

References and patches

https://patchstack.com/database/wordpress/plugin/unlimited-elements-for-elementor/vulnerability/wordpress-unl… vdb-entry

CVSS score

6.5Medium

Source: Patchstack · CVSS 3.1

Attack vector: Network
Attack complexity: Low
Privileges required: Low
User interaction: None
Scope: Unchanged
Confidentiality: High
Integrity: None
Availability: None

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

All scores (2)

cna	CVSS 3.1	6.5Medium
audit@patchstack.com	CVSS 3.1	6.5Medium

EPSS (chance of exploitation in 30 days)

0.44%

higher than 39% of all CVEs

CISA assessment (SSVC)

Exploitation: none
Automatable: no
Technical impact: partial

Timeline

ID reserved2026-02-25
Published2026-08-06 17:27
Reached IP-DB2026-10-24 23:48
Last updated2026-10-24 00:10

Assigned by (CNA): Patchstack
NVD status: Deferred

View at source: CVE.org · NVD

Get told when these products get a new vulnerability

Turn on email alerts

Free · with an account · switch off any time

Recent CVEs in the same product — WordPress plugins & themes

Unscored

CVE-2026-124822 2 hours ago

Easy DragDrop File Uploader < 1.1.10 - Unauthenticated Arbitrary File Deletion via Path Traversal

Easy DragDrop File Uploader

The Easy DragDrop File Uploader WordPress plugin before 1.1.10 does not validate a user-supplied path before deleting it, allowing unauthenticated users to delete arbitrary files and directories on the server, such as wp-config.php.

Unscored

CVE-2026-124833 2 hours ago

Ahime Image Printer <= 1.0.0 - Unauthenticated Arbitrary File Upload

Ahime Image Printer

The Ahime Image Printer WordPress plugin through 1.0.0 does not validate the name, extension or type of uploaded files before writing them to disk, allowing unauthenticated attackers to upload arbitrary files, including PHP, and execute code on the server.

Unscored

CVE-2026-125711 2 hours ago

Trustindex Review Widget Plugins < 14.3 - Editor+ Stored XSS via Business Name

Widgets for Google Reviews; WP Tripadvisor Review Widgets; Widgets for Booking.com Reviews; Widgets for Reviews & Recommendations

The Widgets for Google Reviews WordPress plugin before 14.3, WP Tripadvisor Review Widgets WordPress plugin before 14.3, Widgets for Booking.com Reviews WordPress plugin before 14.3, Widgets for Reviews & Recommendations WordPress plugin before 14.3, Widgets …

Unscored

CVE-2026-125912 2 hours ago

WP Ultimate CSV Importer < 9.2 - Multisite Subsite Admin+ Network-Wide PHP Code Execution via Media Import

WP Ultimate CSV Importer

The WP Ultimate CSV Importer WordPress plugin before 9.2 does not restrict the destination filename and extension, nor validate the fetched content type, when importing remote media, allowing an Administrator of a Multisite subsite to write and execute arbit…

Unscored

CVE-2026-126119 2 hours ago

Streamit Plugin < 1.3.10 - Unauthenticated Remote Code Execution via Arbitrary Function Call

Streamit

The Streamit WordPress plugin before 1.3.10 does not perform any authorization or nonce verification on one of its unauthenticated AJAX routes, which invokes an attacker-supplied PHP function with an attacker-supplied argument array, allowing unauthenticated …

Unscored

CVE-2026-123097 2 hours ago

WP Remote Users Sync < 2.2.1 - Privilege Escalation to Administrator via 'create' and 'update' Sync Actions

WP Remote Users Sync

The WP Remote Users Sync WordPress plugin before 2.2.1 does not restrict which account fields a synchronised site may set when it creates or updates users, allowing a site holding the shared synchronisation keys to assign the administrator role, modify any ex…