CVE-2026-48837

The Unlimited Elements For Elementor plugin has a weakness in its handling of user input, allowing malicious users with contributor or higher level access to inject unauthorized SQL code into database queries. This vulnerability arises from inadequate protection against SQL injection attacks on parameters provided by users and insufficient validation of existing SQL commands. As a result, sensitive information can be extracted from the database.

Based on public CVE data (MITRE/NVD).