Threats tagged 'ghsa-rc6c-xxc7-jg93'

CVE-2026-28146 is a path traversal vulnerability in Unlimited Elements For Elementor (Free Widgets, Addons, Templates) affecting versions up to 2.0.14. It allows a contributor-level user to perform arbitrary file download by exploiting improper limitation of pathname to a restricted directory. The vulnerability has a CVSS score of 6.5, indicating medium severity. No official patch or remediation guidance is currently available from the vendor. There are no known exploits in the wild at this time.