High severity8.5NVD Advisory· Published May 25, 2026· Updated May 26, 2026

CVE-2026-48837

Description

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Unlimited Elements For Elementor allows Blind SQL Injection.

This issue affects Unlimited Elements For Elementor: from n/a through 2.0.8.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

WordPress/Unlimited Elements For Elementorinferred2 versions
<=2.0.8+ 1 more
- (no CPE)range: <=2.0.8
- (no CPE)range: <=2.0.8
Package: https://wordpress.org/plugins/unlimited-elements-for-elementor

Patches

Vulnerability mechanics

References

patchstack.com/database/wordpress/plugin/unlimited-elements-for-elementor/vulnerability/wordpress-unlimited-elements-for-elementor-free-widgets-addons-templates-plugin-2-0-8-sql-injection-vulnerabilitynvd

News mentions

Wordfence Intelligence Weekly WordPress Vulnerability Report (May 25, 2026 to May 31, 2026)
Wordfence Blog · Jun 4, 2026

cvss	0.552
epss	0.000
exploit	0.000
kev	0.000
patch	-0.070
ransomware	0.000