CVE-2026-92924

Name of the Vulnerable Software and Affected Versions Unlimited Elements for Elementor versions prior to 2.0.21

Description The plugin fails to verify if requests to render widget output are made by authorized users. This allows users with low-level permissions, such as the subscriber role, to execute arbitrary WordPress shortcodes on the site. In versions from 2.0.18 onwards, the required permission level was increased to the Contributor role or above.

Recommendations Update the plugin to version 2.0.21 or later.