CVE-2026-75586 Details

A reflected cross-site scripting vulnerability has been identified in the Unlimited Elements for Elementor plugin for WordPress, affecting all versions up to and including 2.0.17. The vulnerability arises from inadequate input sanitization and output escaping, allowing unauthenticated attackers to inject arbitrary web scripts into pages. These scripts can be executed if the attacker successfully persuades a user to perform an action, such as clicking a link. The issue is triggered through the front-end AJAX handler, which is publicly accessible without nonce, capability, or referer checks. The vulnerability exploits the 'formData[id]' parameter, with the raw attacker-controlled id value being directly inserted into an exception message that is returned to the user without proper escaping. When the response is delivered as text/html instead of application/json, the browser executes the injected markup.