What’s Vulnerable › Vulnerabilities

CVE-2026-66608: WordPress Unlimited Elements For Elementor (Free Widgets, Addons, Templates) plugin <= 2.0.19 - Server Side Request Forgery (SSRF) vulnerability

• Severity: medium (CVSS 6.4 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.2% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-09-17 · updated 2026-09-17
• Weakness: CWE-918

Description

Contributor Server Side Request Forgery (SSRF) in Unlimited Elements For Elementor (Free Widgets, Addons, Templates) <= 2.0.19 versions.

Affected products

• unitecms Unlimited Elements For Elementor: through 2.0.19

References

• https://patchstack.com/database/wordpress/plugin/unlimited-elements-for-elementor/vulnerability/wordpress-unlimited-elements-for-elementor-free-widgets-addons-templates-plugin-2-0-19-server-side-request-forgery-ssrf-vulnerability?_s_id=cve

Get alerted when CVE-2026-66608 or the next vulnerability affects your stack