CVE-2024-2662

HIGH

Unlimited Elements For Elementor <1.5.102 - Command Injection

Title source: llm

Description

The Unlimited Elements For Elementor (Free Widgets, Addons, Templates) plugin for WordPress is vulnerable to command injection in all versions up to, and including, 1.5.102. This is due to insufficient filtering of template attributes during the creation of HTML for custom widgets This makes it possible for authenticated attackers, with administrator-level access and above, to execute arbitrary commands on the server.

References (2)

Core 2

Core References

Patch

https://plugins.trac.wordpress.org/changeset/3071404/unlimited-elements-for-elementor/trunk/inc_php/unitecreator_template_engine.class.php

Third Party Advisory

https://www.wordfence.com/threat-intel/vulnerabilities/id/58492dbb-b9e0-4477-b85d-ace06dba954c?source=cve

Scores

CVSS v3 7.2

EPSS 0.0175

EPSS Percentile 74.9%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

CISA SSVC

Vulnrichment

Exploitation none

Automatable no

Technical Impact total

Details

CWE

CWE-78

Status published

Products (2)

unitecms/Unlimited Elements For Elementor < 1.5.102

unlimited-elements/unlimited_elements_for_elementor < 1.5.103

Published May 14, 2024

Tracked Since Feb 18, 2026