All vulnerabilities
CVE-2026-85016

Unlimited Elements For Elementor < 2.0.21 - Contributor+ Stored XSS via Icon Library Parameter

Unknown Unlimited Elements for Elementor
Open in ThreatlineRecord JSON
CVSS
6.8Medium
ExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)0.24%Chance of exploitation activity in the next 30 days, higher than 13% of CVEs. Scored 23 Oct 2026FIRST EPSS
Fixed in2.0.21Fixed versionCVE List
Published2 Oct 2026Updated 2 Oct 2026CVE List

What fixes it

  • 2.0.21Unlimited Elements for ElementorCVE List

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Description

The Unlimited Elements for Elementor WordPress plugin before 2.0.21 does not escape an icon value before concatenating it into an HTML attribute in its shared widget-parameter processor, allowing users with Contributor access (who do not hold unfiltered_html) to store a payload that executes when the page is rendered.

Text from CVE List

Affected versions 1

  • Unlimited Elements for Elementoraffected: all versions before 2.0.21CVE List

References 1