CVE Database /
CVE-2026-28146
CVE · Medium
CVE-2026-28146 — Unlimited Elements For Elementor [unlimited-elements-for-elementor] < 2.0.15
| CVE |
Vulnerability |
Type |
Severity |
Affected |
Fixed in |
Published |
Status |
|
CVE-2026-28146
|
Unlimited Elements For Elementor [unlimited-elements-for-elementor] < 2.0.15 |
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') |
Medium
6.5
|
< 2.0.15
|
2.0.15 |
2026-08-03 |
—
|
CVE-2026-28146
An arbitrary file download vulnerability exists in certain free widgets and templates for the Elementor plugin, specifically those bundled with the Unlimited Elements add-on, affecting versions prior to 2.0.15. This issue allows contributors to access files they shouldn't have access to. The problem is present in plugins up to version 2.0.14.
Based on public CVE data (MITRE/NVD).
Scan your WordPress site free
No signup, no credit card — enter your URL and get a security report in seconds.
See the full security page for this plugin
Browse the CVE database
Browse all security findings