Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Unlimited Elements Unlimited Elements For… (CVE-2026-103355)

CVE-2026-103355 is an SQL Injection vulnerability in Unlimited Elements For Elementor (Free Widgets, Addons, Templates) that allows blind SQL injection attacks. The affected versions include all versions up to and including 2.0.20. The vulnerability enables an attacker with network access and no privileges or user interaction to cause a confidentiality breach and partial availability impact. The CVSS 3.1 vector is AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L, reflecting network attack vector, low attack complexity, no privileges required, no user interaction, scope changed, high confidentiality impact, no integrity impact, and low availability impact.

An attacker can exploit this vulnerability remotely without authentication or user interaction to perform blind SQL injection attacks. This can lead to unauthorized disclosure of sensitive information (high confidentiality impact) and partial disruption of service (low availability impact). There is no integrity impact reported. The vulnerability affects the confidentiality and availability of the affected system.

No patch or official fix information is provided in the available data. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, users should consider limiting network exposure of the affected component and monitor for unusual database activity related to the plugin.