medium5.4
CVE-2026-92924
The Unlimited Elements for Elementor WordPress plugin before 2.0.21 does not check that a request to render widget output comes from a user allowed to make it,…
Impact
The Unlimited Elements for Elementor WordPress plugin before 2.0.21 does not check that a request to render widget output comes from a user allowed to make it, allowing users with a role as low as subscriber to have arbitrary WordPress shortcodes executed on the site. Version 2.0.18 removed the subscriber-level access, so from 2.0.18 onward the issue requires a Contributor role or above.
Affected products
| Product | Affected versions |
|---|---|
| Unlimited Elements For Elementor WordPress Plugin | before 2.0.21 |
Versions were read from the advisory text. No structured product data has been published for this record yet.