Unlimited Elements For Elementor < 2.0.21 - Unauthenticated SQL Injection via AJAX Search 'ucs' Parameter
- ID
- WPSEC-2026-0030
- Plugin
- Unlimited Elements for Elementor (unlimited-elements-for-elementor)
- Affected
- from 1.5.139 before 2.0.21
- Remediation
- Update to 2.0.21 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
- Weakness
- CWE-89
- Usage
- Plugin Medium · Affected versions Medium among sites WPSec scans, 2026-10-22
- Attack surface
- Unlimited Elements For Elementor on WPSec AttackSurface
- Fix released
- Published
Also published later by Wpvulnerability as CVE-2026-85568, on 2026-10-03.
Description
The Unlimited Elements for Elementor plugin for WordPress is vulnerable to SQL Injection via the search term ('ucs' parameter) of the front-end AJAX search and filter requests in versions 1.5.139 up to, and including, 2.0.20. When an AJAX Search widget limits the searched post fields ('Search By' other than 'All'), the plugin removed the other fields from WordPress's already prepared search SQL with a regular expression (setWherePostParts on the posts_where filter) that stops at the first single quote, including an escaped one, so a search term containing a quote leaves the rest of the term outside the string literal. This makes it possible for unauthenticated attackers to append additional SQL to the query and extract sensitive information from the database on sites that use such a widget and the default wp_ table prefix.
References
- https://wpsec.com/vuln/WPSEC-2026-0030/
- https://plugins.svn.wordpress.org/unlimited-elements-for-elementor/tags/2.0.21/
- https://wordpress.org/plugins/unlimited-elements-for-elementor/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS