CVE-2026-95534

{
  "etk_id": "ETK-2026-915",
  "cve_id": "CVE-2026-95534",
  "display_id": "CVE-2026-95534",
  "ghsa_id": "GHSA-5v8m-ppqr-qj2h",
  "euvd_id": "EUVD-2026-94488",
  "status": "published",
  "anchor_state": "anchored",
  "title": "Object injection in Unlimited Elements for Elementor",
  "summary": "Unlimited Elements For Elementor versions through 2.0.19 are affected by an insecure deserialization flaw. An attacker with the required privileges may be able to trigger object injection through the affected plugin.",
  "mitigation": "Update the plugin to a vendor release newer than 2.0.19 after confirming it includes the correction. Until then, deactivate the plugin where feasible and restrict access to accounts permitted to administer or use it.",
  "vendor": "Unlimited Elements",
  "product": "Unlimited Elements For Elementor (Free Widgets, Addons, Templates)",
  "affected": [
    {
      "affected_notes": [
        ">= n/a, <= 2.0.19"
      ],
      "affected_ranges": [],
      "ecosystem": null,
      "fixed_versions": [],
      "package_name": "unlimited-elements-for-elementor",
      "purl": null
    }
  ],
  "cwes": null,
  "cvss_score": 8.8,
  "cvss_src": "cna_vendor",
  "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
  "epss_score": 0.0029,
  "epss_percentile": 0.2005,
  "epss_asof": "2026-10-20",
  "automation": "contextual",
  "check": false,
  "check_confidence_basis": null,
  "exploit": false,
  "pipeline_minutes": 41.9449727,
  "t0_at": "2026-10-07T17:00:23.166000+00:00",
  "signals": {
    "trigger_signal": {
      "at": "2026-10-07T17:00:23.166000+00:00",
      "days": 0,
      "is_lower_bound": false,
      "measured_at": "2026-10-07T17:00:23.166000+00:00",
      "url": "https://github.com/advisories/GHSA-5v8m-ppqr-qj2h"
    }
  }
}