CVE WATCH / VULNERABILITY DETAIL
CVE-2026-116558
HIGHCVSS 7.2NVD feed
Published 7 November 2026 · tracked since 8 November 2026
Description
The Unlimited Elements for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the '<title>/<description> inside the attacker-controlled RSS feed body' parameter in all versions up to, and including, 2.0.26 due to insufficient input sanitization and output escaping. This
References
- NVD — National Vulnerability Database
- CVE.org record (MITRE)
- CISA Known Exploited Vulnerabilities catalog
Latest tracked vulnerabilities
- CVE-2026-124318 HIGH 7.2
- CVE-2026-122041 CRITICAL 9.1
- CVE-2026-120841 HIGH 8.8
- CVE-2026-120839 HIGH 8.8
- CVE-2026-119156 HIGH 7.2
- CVE-2026-93766 HIGH 7.2
- CVE-2026-93755 HIGH 7.2
- CVE-2026-93429 HIGH 7.2
- CVE-2026-123418 HIGH 7.2
- CVE-2026-122231 HIGH 7.2