CVE-2026-92923

Name of the Vulnerable Software and Affected Versions Unlimited Elements for Elementor versions prior to 2.0.21

Description Insufficient sanitization and escaping of a parameter used in a SQL statement allows authenticated users to perform blind SQL injection attacks. This flaw enables the extraction of arbitrary data from the database. While initially accessible to users with the subscriber role, access was restricted starting from version 2.0.18, meaning subsequent versions require a Contributor role or higher to exploit the issue.

Recommendations Update Unlimited Elements for Elementor to version 2.0.21 or later.