CVE-2026-103355

Published Oct 4, 2026·Updated Oct 6, 2026

NVD Description

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Unlimited Elements Unlimited Elements For Elementor (Free Widgets, Addons, Templates) unlimited-elements-for-elementor allows Blind SQL Injection.This issue affects Unlimited Elements For Elementor (Free Widgets, Addons, Templates): from n/a through 2.0.20.

Public Exploits & PoCs1 found

[POC] CVE-2026-103355 — CVE-2026-103355-unlimited-elements-sqli-poc

CVE-2026-103355 - Unlimited Elements For Elementor <= 2.0.20 unauthenticated blind SQL injection via terms-listing identifiers (CVSS 9.3): Docker validation lab with vulnerable (2.0.20) vs patched (2.0.21) controls, read-only boolean-oracle PoC, nuclei version screen. Authorized security research only.

CVSS Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L

References

View on NVD Search GitHub Search Google

Get alerted for CVEs like this

Start monitoring free