CVE-2026-94662

{
  "etk_id": "ETK-2026-935",
  "cve_id": "CVE-2026-94662",
  "display_id": "CVE-2026-94662",
  "ghsa_id": "GHSA-mwrm-433x-r42p",
  "euvd_id": "EUVD-2026-94485",
  "status": "published",
  "anchor_state": "anchored",
  "title": "Stored cross-site scripting in Unlimited Elements for Elementor",
  "summary": "Unlimited Elements for Elementor releases through 2.0.19 are affected by a stored cross-site scripting issue. An attacker may be able to cause browser-executed script to be saved in affected content and later run for users who view it. The advisory does not state the required access level or vulnerable input path.",
  "mitigation": "Deactivate the plugin or restrict untrusted users from submitting or editing its content until an updated release is confirmed to remediate the issue. Review saved plugin content for untrusted markup before re-enabling it.",
  "vendor": "Unlimited Elements",
  "product": "Unlimited Elements For Elementor (Free Widgets, Addons, Templates)",
  "affected": [
    {
      "affected_notes": [
        ">= n/a, <= 2.0.19"
      ],
      "affected_ranges": [],
      "ecosystem": null,
      "fixed_versions": [],
      "package_name": "unlimited-elements-for-elementor",
      "purl": null
    }
  ],
  "cwes": null,
  "cvss_score": 7.1,
  "cvss_src": "cna_vendor",
  "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L",
  "epss_score": 0.0015,
  "epss_percentile": 0.035,
  "epss_asof": "2026-10-21",
  "automation": "contextual",
  "check": true,
  "check_confidence_basis": "assessed",
  "exploit": false,
  "pipeline_minutes": 57.608444166666665,
  "t0_at": "2026-10-07T16:55:21.832000+00:00",
  "signals": {
    "check": {
      "at": "2026-10-08T05:52:07.919969+00:00",
      "days": 0.5394223144560185,
      "is_lower_bound": false,
      "measured_at": "2026-10-07T16:55:21.832000+00:00",
      "url": null
    },
    "trigger_signal": {
      "at": "2026-10-07T16:55:21.832000+00:00",
      "days": 0,
      "is_lower_bound": false,
      "measured_at": "2026-10-07T16:55:21.832000+00:00",
      "url": "https://github.com/advisories/GHSA-mwrm-433x-r42p"
    }
  }
}