CVE-2026-5486

The Unlimited Elements for Elementor plugin for WordPress contains a SQL injection vulnerability in versions up to 2.0.7. The issue arises from a combination of inadequate input validation, the use of outdated escaping functions, and direct string concatenation in SQL queries. Specifically, user input is first stripped of slashes, then escaped using a deprecated function, and finally concatenated into a LIKE clause without the protection of prepared statements. This vulnerability allows authenticated attackers with Contributor-level access or higher to inject malicious SQL code and potentially extract sensitive database information.

Based on public CVE data (MITRE/NVD).