CVE-2026-105064: Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection') in Unlimited Elements Unlimited Elements For Elementor (Free Widgets, Addons, Templates)

This vulnerability involves the use of externally-controlled input to select classes or code, known as unsafe reflection, in the Unlimited Elements For Elementor plugin. Specifically, parameter injection is possible, which could allow an attacker to influence which classes or code are executed. The affected versions are from the initial release up to 2.0.22 inclusive. The CVSS 3.1 score is 6.5, indicating a medium severity with network attack vector, low complexity, low privileges required, no user interaction, unchanged scope, and high confidentiality impact.

An attacker with low privileges can exploit this vulnerability remotely without user interaction to cause unauthorized disclosure of information due to unsafe reflection and parameter injection. The integrity and availability of the system are not impacted according to the CVSS vector.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or patch links are provided in the available data. Until a patch is available, restrict access to trusted users and monitor for suspicious activity related to parameter injection attempts.