CVE-2026-95534High· 8.8▾ Twilight

Deserialization of Untrusted Data vulnerability in Unlimited Elements Unlimited Elements For Elementor (Free Widgets, Addons, Templates) allows Object Injection. This issue affects Unlimited Elements For Elementor (Free Widgets, Addons,…

▾ Twilight zone — High severity, or a signal on a lesser flaw

Depth score48/ 100 · Moderate

impact 48.4 · likelihood 0 · exploitation 0

⚡ Agent-ready:Raw markdown ↗JSON ↗

Proof of concept

Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.

…

Published

Oct 7, 2026

Updated

Oct 7, 2026

CVSS

8.8

Vendor

Unlimited Elements

Product

unlimited-elements-for-elementor

CWE

CWE-502

Depth score

48 · Moderate

EPSS

—

Platforms

—

Source

NVD

Vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Unlimited Elements CWE-502 #nvd #cve.org

Affected

unlimited-elements-for-elementor >= n/a <= 2.0.19

Full technical detail▾

Overview

Deserialization of Untrusted Data vulnerability in Unlimited Elements Unlimited Elements For Elementor (Free Widgets, Addons, Templates) allows Object Injection.

This issue affects Unlimited Elements For Elementor (Free Widgets, Addons, Templates): from n/a through 2.0.19.

Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.

References

[email protected] — https://patchstack.com/database/wordpress/plugin/unlimited-elements-for-elementor/vulnerability/wordpress-unlimited-elements-for-elementor-free-widgets-addons-templates-plugin-2-0-19-php-object-injection-vulnerability?_s_id=cve

Related vulnerabilities

Connected by shared product, vendor, weakness, or advisory.

#nvd#cve.org