¿Es seguro Unlimited Elements For Elementor?

Qué hace este plugin

• Slug: unlimited-elements-for-elementor
• Autor: Unlimited Elements
• 300000+ instalaciones activas
• 96/100 calificación (520 reseñas en wordpress.org)
• 15405500 descargas totales
• En WordPress.org desde 2018-02-01

elementorelementor addonselementor templateselementor widgetswidgets for elementor

Estado de mantenimiento

• Última actualización: 2026-07-22 9:44am GMT
• Probado hasta WordPress: 7.0.2
• Requiere PHP: 7.4+

Vulnerabilidades conocidas

37 CVEs conocidos registrados para Unlimited Elements For Elementor.

CVE-2026-10081

The Unlimited Elements For Elementor WordPress plugin before 2.0.11 does not sanitize or escape Google review content fetched from the Serp API before rendering it in the Google Reviews widget output, allowing unauthenticated attackers who submit a malicious review on the targeted business's Google listing to deliver Stored XSS to any visitor (including administrators) of any WP page displaying that Place ID's reviews.

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: CVE.org

CVE-2026-57718

The Unlimited Elements For Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 2.0.12 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: Wordfence

CVE-2026-48837

The Unlimited Elements For Elementor plugin for WordPress is vulnerable to SQL Injection in versions up to, and including, 2.0.8 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with contributor-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: Wordfence

CVE-2026-5486

The Unlimited Elements for Elementor plugin for WordPress is vulnerable to SQL Injection via the 'data[filter_search]' parameter in the get_cat_addons AJAX action in versions up to and including 2.0.7. This is due to insufficient input sanitization and the use of deprecated escaping functions combined with direct string concatenation in SQL query construction. The vulnerability is exacerbated because the normalizeAjaxInputData() function calls stripslashes() on all user input, removing the protection provided by WordPress's wp_magic_quotes() function. Subsequently, the filter_search parameter is escaped using the deprecated wpdb->_escape() function and then directly concatenated into a LIKE clause without using prepared statements. This makes it possible for authenticated attackers, with Contributor-level access and above (who can obtain a valid nonce through the Elementor editor), to inject arbitrary SQL commands and extract sensitive information from the database.

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: CVE.org

CVE-2024-13362

Varios plugins y/o temas para WordPress son vulnerables a Reflected Cross-Site Scripting (XSS) a través del parámetro url en diversas versiones debido a una sanitización de entrada insuficiente y un escape de salida inadecuado. Esto permite que atacantes no autenticados inyecten scripts web arbitrarios en páginas que se ejecutan si pueden engañar a un usuario para que realice una acción, como hacer clic en un enlace.

Traducción automática del texto original de la fuente. Ver original

Fuente: CVE.org

CVE-2026-4659

The Unlimited Elements for Elementor plugin for WordPress is vulnerable to Arbitrary File Read via the Repeater JSON/CSV URL parameter in versions up to, and including, 2.0.6. This is due to insufficient path traversal sanitization in the URLtoRelative() and urlToPath() functions, combined with the ability to enable debug output in widget settings. The URLtoRelative() function only performs a simple string replacement to remove the site's base URL without sanitizing path traversal sequences (../), and the cleanPath() function only normalizes directory separators without removing traversal components. This allows an attacker to provide a URL like http://site.com/../../../../etc/passwd which, after URLtoRelative() strips the domain, results in /../../../../etc/passwd being concatenated with the base path and ultimately resolved to /etc/passwd. This makes it possible for authenticated attackers with Author-level access and above to read arbitrary local files from the WordPress host, including sensitive files such as wp-config.

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: CVE.org

CVE-2025-14274

The Unlimited Elements for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Border Hero widget's Button Link field in versions up to 2.0.1. This is due to insufficient input sanitization and output escaping on user-supplied URLs. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: CVE.org

CVE-2025-13692

The Unlimited Elements For Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up to, and including, 2.0 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses the SVG file. A form with a file upload field must be created with the premium version of the plugin in order to exploit the vulnerability. However, once the form exists, the vulnerability is exploitable even if the premium version is deactivated and/or uninstalled.

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: CVE.org

+ 33 vulnerabilidades conocidas más

CVE	Vulnerabilidad	Tipo	Gravedad	Afectadas	Corregido en	Publicado	Estado
CVE-2024-13155	Unlimited Elements For Elementor [unlimited-elements-for-elementor] < 1.5.141	Neutralización incorrecta de la entrada al generar la página web (Cross-site Scripting / XSS)	Media 6,4	< 1.5.141	1.5.141	2025-02-19	—
CVE-2024-13153	Unlimited Elements For Elementor [unlimited-elements-for-elementor] < 1.5.136	Neutralización incorrecta de la entrada al generar la página web (Cross-site Scripting / XSS)	Media 6,4	< 1.5.136	1.5.136	2025-01-08	—
CVE-2024-10784	Unlimited Elements For Elementor [unlimited-elements-for-elementor] < 1.5.127	Neutralización incorrecta de la entrada al generar la página web (Cross-site Scripting / XSS)	Media 6,4	< 1.5.127	1.5.127	2024-12-11	—
CVE-2024-49271	Unlimited Elements For Elementor [unlimited-elements-for-elementor] < 1.5.122	Neutralización incorrecta de scripts en atributos de etiquetas IMG en una página web	Crítica 9,1	< 1.5.122	1.5.122	2024-10-14	—
CVE-2024-45454	Unlimited Elements For Elementor [unlimited-elements-for-elementor] < 1.5.122	Neutralización incorrecta de la entrada al generar la página web (Cross-site Scripting / XSS)	Alta 7,1	< 1.5.122	1.5.122	2024-09-30	—
CVE-2024-6170	Unlimited Elements For Elementor [unlimited-elements-for-elementor] < 1.5.113	Neutralización incorrecta de la entrada al generar la página web (Cross-site Scripting / XSS)	Media 5,4	< 1.5.113	1.5.113	2024-07-08	—
CVE-2024-6169	Unlimited Elements For Elementor [unlimited-elements-for-elementor] < 1.5.113	Neutralización incorrecta de la entrada al generar la página web (Cross-site Scripting / XSS)	Media 5,4	< 1.5.113	1.5.113	2024-07-08	—
CVE-2024-6171	Unlimited Elements For Elementor [unlimited-elements-for-elementor] < 1.5.113	Uso de una fuente menos confiable	Media 5,3	< 1.5.113	1.5.113	2024-07-08	—
CVE-2024-6166	Unlimited Elements For Elementor [unlimited-elements-for-elementor] < 1.5.113	Neutralización incorrecta de elementos especiales en un comando SQL (inyección SQL)	Alta 8,8	< 1.5.113	1.5.113	2024-07-08	—
CVE-2024-35674	Unlimited Elements For Elementor [unlimited-elements-for-elementor] < 1.5.110	Falta de control de autorización	Media 4,3	< 1.5.110	1.5.110	2024-06-05	—
CVE-2024-5329	Unlimited Elements For Elementor [unlimited-elements-for-elementor] < 1.5.110	Neutralización incorrecta de elementos especiales en un comando SQL (inyección SQL)	Alta 8,8	< 1.5.110	1.5.110	2024-06-05	—
CVE-2024-3190	Unlimited Elements For Elementor [unlimited-elements-for-elementor] < 1.5.108	Neutralización incorrecta de la entrada al generar la página web (Cross-site Scripting / XSS)	Media 4,6	< 1.5.108	1.5.108	2024-05-29	—
CVE-2023-6743	Unlimited Elements For Elementor [unlimited-elements-for-elementor] < 1.5.91	Control incorrecto de la generación de código (inyección de código)	Alta 8,8	< 1.5.91	1.5.91	2024-05-28	—
CVE-2024-4779	Unlimited Elements For Elementor [unlimited-elements-for-elementor] < 1.5.108	Neutralización incorrecta de elementos especiales en un comando SQL (inyección SQL)	Alta 8,8	< 1.5.108	1.5.108	2024-05-22	—
CVE-2024-3055	Unlimited Elements For Elementor [unlimited-elements-for-elementor] < 1.5.105	Neutralización incorrecta de elementos especiales en un comando SQL (inyección SQL)	Alta 8,8	< 1.5.105	1.5.105	2024-05-10	—
CVE-2024-2662	Unlimited Elements For Elementor [unlimited-elements-for-elementor] < 1.5.103	Neutralización incorrecta de elementos especiales en un comando del sistema operativo (inyección de comandos del SO)	Alta 7,2	< 1.5.103	1.5.103	2024-05-09	—
CVE-2024-3547	Unlimited Elements For Elementor [unlimited-elements-for-elementor] < 1.5.103	Neutralización incorrecta de la entrada al generar la página web (Cross-site Scripting / XSS)	Media 6,1	< 1.5.103	1.5.103	2024-05-09	—
CVE-2024-0367	Unlimited Elements For Elementor [unlimited-elements-for-elementor] < 1.5.97	Neutralización incorrecta de la entrada al generar la página web (Cross-site Scripting / XSS)	Media 5,4	< 1.5.97	1.5.97	2024-03-29	—
CVE-2024-29792	Unlimited Elements For Elementor [unlimited-elements-for-elementor] < 1.5.94	Neutralización incorrecta de la entrada al generar la página web (Cross-site Scripting / XSS)	Alta 7,1	< 1.5.94	1.5.94	2024-03-25	—
CVE-2023-33999	Unlimited Elements For Elementor [unlimited-elements-for-elementor] < 1.5.75	Neutralización incorrecta de la entrada al generar la página web (Cross-site Scripting / XSS)	Alta 7,1	< 1.5.75	1.5.75	2023-07-18	—
CVE-2023-31080	Unlimited Elements For Elementor [unlimited-elements-for-elementor] < 1.5.66	Falta de control de autorización	Alta 8,3	< 1.5.66	1.5.66	2023-06-20	—
CVE-2023-31231	Unlimited Elements For Elementor [unlimited-elements-for-elementor] < 1.5.66	Carga de archivos sin restricción de tipo peligroso	Crítica 9,9	< 1.5.66	1.5.66	2023-06-20	—
CVE-2023-3295	Unlimited Elements For Elementor [unlimited-elements-for-elementor] < 1.5.67	Carga de archivos sin restricción de tipo peligroso	Alta 8,8	< 1.5.67	1.5.67	2023-06-16	—
CVE-2023-31090	Unlimited Elements For Elementor [unlimited-elements-for-elementor] < 1.5.61	Carga de archivos sin restricción de tipo peligroso	Crítica 9,9	< 1.5.61	1.5.61	2023-05-22	—
CVE-2023-33930	Unlimited Elements For Elementor [unlimited-elements-for-elementor] < 1.5.67	Carga de archivos sin restricción de tipo peligroso	Crítica 9,1	< 1.5.67	1.5.67	2023-05-22	—
CVE-2022-47170	Unlimited Elements For Elementor [unlimited-elements-for-elementor] < 1.5.49	Neutralización incorrecta de la entrada al generar la página web (Cross-site Scripting / XSS)	Media 5,9	< 1.5.49	1.5.49	2023-01-27	—
—	Unlimited Elements For Elementor [unlimited-elements-for-elementor] < 1.5.3	Falta de control de autorización	Media 6,3	< 1.5.3	1.5.3	2022-03-04	—
—	Unlimited Elements For Elementor [unlimited-elements-for-elementor] < 1.5.3	—	Desconocido	< 1.5.3	1.5.3	2022-02-28	—
—	Unlimited Elements For Elementor [unlimited-elements-for-elementor] < 1.5.3	—	Desconocido	< 1.5.3	1.5.3	2022-02-28	—
CVE-2025-1663	Unlimited Elements For Elementor [unlimited-elements-for-elementor] < 1.5.143	Neutralización incorrecta de la entrada al generar la página web (Cross-site Scripting / XSS)	Media 5,4	< 1.5.143	1.5.143	0000-00-00	—
CVE-2025-8603	Unlimited Elements For Elementor [unlimited-elements-for-elementor] < 1.5.149	Neutralización incorrecta de la entrada al generar la página web (Cross-site Scripting / XSS)	Media 6,4	< 1.5.149	1.5.149	0000-00-00	—
CVE-2026-2724	Unlimited Elements For Elementor [unlimited-elements-for-elementor] < 2.0.6	—	Desconocido	< 2.0.6	2.0.6	0000-00-00	—
—	Unlimited Elements For Elementor [unlimited-elements-for-elementor] < 1.5.3	—	Desconocido	< 1.5.3	1.5.3	—	—

CVE-2024-13155

The Unlimited Elements For Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Transparent Split Hero widget in all versions up to, and including, 1.5.140 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Note: Since the widget code isn't part of the code base, to apply the patch, the affected widget: Transparent Split Hero must be deleted and reinstalled manually.

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: CVE.org

CVE-2024-13153

The Unlimited Elements For Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via multiple widgets in all versions up to, and including, 1.5.135 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Note: Since the widget code isn't part of the code base, to apply the patch, the affected widgets: Image Tooltip, Notification, Simple Popup, Video Play Button, and Card Carousel, must be deleted and reinstalled manually.

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: CVE.org

CVE-2024-10784

The Unlimited Elements For Elementor (Free Widgets, Addons, Templates) plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘Tile Gallery' widget in all versions up to, and including, 1.5.126 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: CVE.org

CVE-2024-49271

The Unlimited Elements For Elementor (Free Widgets, Addons, Templates) plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1.5.121 via the template engine. This is due to the plugin not properly restricting functions that can be called and passed to code execution functions. This makes it possible for authenticated attackers, with Editor-level access and above, to execute code on the server.

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: Wordfence

CVE-2024-45454

The Unlimited Elements For Elementor (Free Widgets, Addons, Templates) plugin for WordPress is vulnerable to Reflected Cross-Site Scripting in versions up to, and including, 1.5.121 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: Wordfence

CVE-2024-6170

The Unlimited Elements For Elementor (Free Widgets, Addons, Templates) plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘email’ parameter in all versions up to, and including, 1.5.112 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: CVE.org

CVE-2024-6169

The Unlimited Elements For Elementor (Free Widgets, Addons, Templates) plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘username’ parameter in all versions up to, and including, 1.5.112 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above and granted plugin setting edit permissions by an administrator, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: CVE.org

CVE-2024-6171

The Unlimited Elements For Elementor (Free Widgets, Addons, Templates) plugin for WordPress is vulnerable to IP Address Spoofing in all versions up to, and including, 1.5.112 due to insufficient IP address validation and/or use of user-supplied HTTP headers as a primary method for IP retrieval. This makes it possible for unauthenticated attackers to bypass antispam functionality in the Form Builder widgets.

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: CVE.org

CVE-2024-6166

The Unlimited Elements For Elementor (Free Widgets, Addons, Templates) plugin for WordPress is vulnerable to time-based SQL Injection via the ‘addons_order’ parameter in all versions up to, and including, 1.5.112 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with Contributor-level access and above and granted plugin setting edit permissions by an administrator, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: CVE.org

CVE-2024-35674

<p>WordPress Unlimited Elements For Elementor (Free Widgets, Addons, Templates) Plugin <= 1.5.109 is vulnerable to Broken Access Control</p><p>Software: Unlimited Elements For Elementor (Free Widgets, Addons, Templates)</p><p>Link: https://wordpress.org/plugins/unlimited-elements-for-elementor/#developers</p><p>Affected Version <= 1.5.109</p><p>Fixed in version 1.5.110 </p>

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: Patchstack

CVE-2024-5329

The Unlimited Elements For Elementor (Free Widgets, Addons, Templates) plugin for WordPress is vulnerable to blind SQL Injection via the ‘data[addonID]’ parameter in all versions up to, and including, 1.5.109 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with Contributor-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: CVE.org

CVE-2024-3190

The Unlimited Elements For Elementor (Free Widgets, Addons, Templates) plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's text field widget in all versions up to, and including, 1.5.107 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Please note that this vulnerability is different in that the issue stems from an external template. It appears that older version may also be patched due to this, however, we are choosing 1.5.108 as the patched version since that is the most recent version containing as known patch.

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: CVE.org

CVE-2023-6743

<p>WordPress Unlimited Elements For Elementor (Free Widgets, Addons, Templates) Plugin <= 1.5.89 is vulnerable to Remote Code Execution (RCE)</p><p>Software: Unlimited Elements For Elementor (Free Widgets, Addons, Templates)</p><p>Link: https://wordpress.org/plugins/unlimited-elements-for-elementor/#developers</p><p>Affected Version <= 1.5.89</p><p>Fixed in version 1.5.91 </p>

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: Patchstack

CVE-2024-4779

The Unlimited Elements For Elementor (Free Widgets, Addons, Templates) plugin for WordPress is vulnerable to SQL Injection via the ‘data[post_ids][0]’ parameter in all versions up to, and including, 1.5.107 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with contributor-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: CVE.org

CVE-2024-3055

The Unlimited Elements For Elementor (Free Widgets, Addons, Templates) plugin for WordPress is vulnerable to time-based SQL Injection via the ‘id’ parameter in all versions up to, and including, 1.5.102 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with contributor access or higher, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: CVE.org

CVE-2024-2662

The Unlimited Elements For Elementor (Free Widgets, Addons, Templates) plugin for WordPress is vulnerable to command injection in all versions up to, and including, 1.5.102. This is due to insufficient filtering of template attributes during the creation of HTML for custom widgets This makes it possible for authenticated attackers, with administrator-level access and above, to execute arbitrary commands on the server.

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: CVE.org

CVE-2024-3547

The Unlimited Elements For Elementor (Free Widgets, Addons, Templates) plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'google_connect_error' parameter in all versions up to, and including, 1.5.102 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: CVE.org

CVE-2024-0367

Update the WordPress Unlimited Elements For Elementor (Free Widgets, Addons, Templates) plugin to the latest available version (at least 1.5.97). Webbernaut discovered and reported this Cross Site Scripting (XSS) vulnerability in WordPress Unlimited Elements For Elementor (Free Widgets, Addons, Templates) Plugin. This could allow a malicious actor to inject malicious scripts, such as redirects, advertisements, and other HTML payloads into your website which will be executed when guests visit your site. This vulnerability has been fixed in version 1.5.97. Have additional information or questions about this entry? Get in touch.

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: Patchstack

CVE-2024-29792

Update the WordPress Unlimited Elements For Elementor (Free Widgets, Addons, Templates) plugin to the latest available version (at least 1.5.94). Rafie Muhammad (Patchstack) discovered and reported this Cross Site Scripting (XSS) vulnerability in WordPress Unlimited Elements For Elementor (Free Widgets, Addons, Templates) Plugin. This could allow a malicious actor to inject malicious scripts, such as redirects, advertisements, and other HTML payloads into your website which will be executed when guests visit your site. This vulnerability has been fixed in version 1.5.94. This vulnerability was reported to and published by Patchstack. Our users receive alerts and protections up to 48 hours in advance. Have additional information or questions about this entry? Get in touch.

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: Patchstack

CVE-2023-33999

Update the WordPress Unlimited Elements For Elementor (Free Widgets, Addons, Templates) plugin to the latest available version (at least 1.5.75). Rafie Muhammad (Patchstack) discovered and reported this Cross Site Scripting (XSS) vulnerability in WordPress Unlimited Elements For Elementor (Free Widgets, Addons, Templates) Plugin. This could allow a malicious actor to inject malicious scripts, such as redirects, advertisements, and other HTML payloads into your website which will be executed when guests visit your site. This vulnerability has been fixed in version 1.5.75.

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: Patchstack

CVE-2023-31080

The Unlimited Elements For Elementor (Free Widgets, Addons, Templates) plugin for WordPress is vulnerable to unauthorized access of data, modification of data, and loss of data due to a missing capability check on the extensive functions throughout the plugin in versions up to, and including, 1.5.65. This makes it possible for authenticated attackers, with contributor-level access and above, to perform a plethora of unauthorized actions such as updating/ deleting/modfying addons and modifying various settings.

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: Wordfence

CVE-2023-31231

Update the WordPress Unlimited Elements For Elementor (Free Widgets, Addons, Templates) plugin to the latest available version (at least 1.5.66). Rafie Muhammad (Patchstack) discovered and reported this Arbitrary File Upload vulnerability in WordPress Unlimited Elements For Elementor (Free Widgets, Addons, Templates) Plugin. This could allow a malicious actor to upload any type of file to your website. This can include backdoors which are then executed to gain further access to your website. This vulnerability has been fixed in version 1.5.66.

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: Patchstack

CVE-2023-3295

The Unlimited Elements For Elementor (Free Widgets, Addons, Templates) for WordPress is vulnerable to arbitrary file uploads due to missing file type validation of files in the file manager functionality in versions up to, and including, 1.5.66 . This makes it possible for authenticated attackers, with contributor-level permissions and above, to upload arbitrary files on the affected site's server which may make remote code execution possible. The issue was partially patched in version 1.5.66 and fully patched in 1.5.67. CVE-2023-31231 appears to be a duplicate of this issue.

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: CVE.org

CVE-2023-31090

The Unlimited Elements For Elementor (Free Widgets, Addons, Templates) for WordPress is vulnerable to arbitrary file uploads due to missing file type validation of files within zip files in the File Manager functionality in versions up to, and including, 1.5.60 . This makes it possible for authenticated attackers, with contributor-level permissions and above, to upload arbitrary files on the affected site's server which may make remote code execution possible.

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: Wordfence

CVE-2023-33930

Update the WordPress Unlimited Elements For Elementor (Free Widgets, Addons, Templates) plugin to the latest available version (at least 1.5.67). Achref Ben Thameur discovered and reported this Bypass Vulnerability vulnerability in WordPress Unlimited Elements For Elementor (Free Widgets, Addons, Templates) Plugin. A bypass vulnerability could allow a malicious actor to bypass certain restrictions in the code. This vulnerability has been fixed in version 1.5.67.

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: Patchstack

CVE-2022-47170

Update the WordPress Unlimited Elements For Elementor (Free Widgets, Addons, Templates) plugin to the latest available version (at least 1.5.49). Muhammad Daffa discovered and reported this Cross Site Scripting (XSS) vulnerability in WordPress Unlimited Elements For Elementor (Free Widgets, Addons, Templates) Plugin. This could allow a malicious actor to inject malicious scripts, such as redirects, advertisements, and other HTML payloads into your website which will be executed when guests visit your site. This vulnerability has been fixed in version 1.5.49.

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: Patchstack

Unlimited Elements For Elementor [unlimited-elements-for-elementor] < 1.5.3

El SDK de Freemius, utilizado por cientos de desarrolladores de plugins y temas de WordPress, estaba expuesto a Cross-Site Request Forgery (CSRF) y revelación de información debido a la falta de comprobaciones de capacidad y protección con nonce en las funciones _get_debug_log, _get_db_option y _set_db_option en versiones hasta y inclusive 2.4.2. Cualquier plugin o tema de WordPress que ejecute una versión de Freemius menor a 2.4.3 es vulnerable.

Traducción automática del texto original de la fuente. Ver original

Fuente: Wordfence

Unlimited Elements For Elementor [unlimited-elements-for-elementor] < 1.5.3

Toggle The Debug Mode via Cross-Site Request Forgery (CSRF) vulnerability discovered in WordPress "Unlimited Elements For Elementor (Free Widgets, Addons, Templates)" plugin (versions < 1.5.3).

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: Patchstack

Unlimited Elements For Elementor [unlimited-elements-for-elementor] < 1.5.3

Sensitive Information Disclosure vulnerability discovered in WordPress "Unlimited Elements For Elementor (Free Widgets, Addons, Templates)" plugin (versions < 1.5.3).

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: Patchstack

CVE-2025-1663

The Unlimited Elements For Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via several widgets in all versions up to, and including, 1.5.142 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: Wordfence

CVE-2025-8603

The Unlimited Elements For Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via several widgets in all versions up to, and including, 1.5.148 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: Wordfence

CVE-2026-2724

The Unlimited Elements for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the form entry fields in all versions up to, and including, 2.0.5. This is due to insufficient input sanitization and output escaping on form submission data displayed in the admin Form Entries Trash view. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever an administrator views the trashed form entries.

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: Wordfence

Unlimited Elements For Elementor [unlimited-elements-for-elementor] < 1.5.3

Los plugins y temas utilizan una versión insegura del marco de trabajo Freemius, que carece de protección contra ataques CSRF y/o autorización en algunas de sus acciones AJAX. Como resultado, cualquier usuario autenticado, como un suscriptor, podría acceder a los registros de depuración. Los atacantes no autenticados también podrían hacer que un administrador conectado active o desactive el modo de depuración mediante un ataque CSRF.

Traducción automática del texto original de la fuente. Ver original

Fuente: WPScan

Cómo solucionarlo

Actualiza este plugin a la última versión de wordpress.org — cada CVE de arriba indica la versión exacta que lo corrigió ("Corregido en") cuando hay una registrada.

Este es el historial completo de vulnerabilidades conocidas del plugin, no un escaneo de una instalación específica — ejecuta un escaneo gratis de tu propio sitio para verificar tu versión instalada exacta.

Alternativas más seguras / más establecidas

• Elementor Website Builder – more than just a page builder — 10000000+ instalaciones activas — 90/100 (7281)
• Ultimate Addons for Elementor — 2000000+ instalaciones activas — 98/100 (2524) — PHP máx. 8.4
• Essential Addons for Elementor – Popular Elementor Templates & Widgets — 2000000+ instalaciones activas — 98/100 (4095) — PHP máx. 8.4
• Starter Templates – AI-Powered Templates for Elementor & Gutenberg — 1000000+ instalaciones activas — 98/100 (4743) — PHP máx. 8.4
• ElementsKit Elementor Addons – Advanced Widgets & Templates Addons for Elementor — 1000000+ instalaciones activas — 98/100 (2027) — PHP máx. 8.4