CVE-2026-62007

HighCVSS 7.1/10Last modified Nov 4, 2026

Description

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Unlimited Elements Unlimited Elements For Elementor (Free Widgets, Addons, Templates) unlimited-elements-for-elementor allows Reflected XSS.This issue affects Unlimited Elements For Elementor (Free Widgets, Addons, Templates): from n/a through 2.0.26.

Metrics

CVSS 3.1 7.1/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L

Weakness enumeration

CWE-79

Affected software

No affected versions have been published.

Timeline

Published
Nov 4, 2026
Last modified
Nov 4, 2026
NVD status
Deferred

Related CVEs from 2026

CVE-2026-620089.8Unauthenticated PHP Object Injection in Orpheus <= 1.8 versions.CVE-2026-620099.8Unauthenticated PHP Object Injection in Filmax <= 1.1.11 versions.CVE-2026-62015.4A vulnerability was identified in CodeAstro Online Job Portal 1.0. The impacted element is an unknown function of the file /jobs/job-delete.CVE-2026-620109.8Unauthenticated PHP Object Injection in Avventure <= 1.1.12 versions.CVE-2026-620119.8Unauthenticated PHP Object Injection in Bonbon <= 1.11 versions.CVE-2026-620129.8Unauthenticated PHP Object Injection in Coinpress <= 1.0.15 versions.CVE-2026-620139.8Unauthenticated PHP Object Injection in Edge Decor <= 2.9 versions.CVE-2026-620149.8Unauthenticated PHP Object Injection in EmojiNation <= 1.0.12 versions.CVE-2026-620159.8Unauthenticated PHP Object Injection in Gamezone <= 1.1.11 versions.CVE-2026-620169.8Unauthenticated PHP Object Injection in Gamic <= 1.19 versions.CVE-2026-620179.8Unauthenticated PHP Object Injection in Good Homes <= 1.3.13 versions.CVE-2026-620189.8Unauthenticated PHP Object Injection in Gunslinger <= 1.11 versions.
CVE-2026-62007: High severity, CVSS 7.1 | Vulnix