What is CVE-2026-85568?

CVE-2026-85568 is a medium-severity vulnerability in Unlimited Elements For Elementor, classified under SQL Injection. CVSS score: 6.8/10. Published 2026-10-03.

How severe is CVE-2026-85568?

Medium severity. CVSS v3 base score is 6.8 out of 10.

SQL Injection in Unlimited Elements For Elementor

CVE-2026-85568

The Unlimited Elements for Elementor WordPress plugin before 2.0.21 does not correctly handle a search value before rewriting an already prepared SQL statement, allowing unauthenticated users to perform SQL injection attacks and to retrieve non-public content, when a related widget option is set away from its default.

Vulnerability class: SQL Injection

Published 2026-10-03 · last modified 2026-10-03.

CVSS v3 metric

CVSS v3 base score 6.8 (Medium). Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:N/A:N.

EPSS exploit prediction

No EPSS score from FIRST.org yet. New CVEs usually get one within a few days; no score means no signal yet, not low risk. How EPSS works.

Affected products

Unlimited Elements For Elementor

Weakness classification (CWE)

CWE-89 — SQL Injection

References

wpscan.com/vulnerability/f4f2c1c5-ced9-44cb-b605-a7ce12ac867f/ (technical-description, exploit, vdb-entry)

Frequently asked questions

What is CVE-2026-85568?: CVE-2026-85568 is a medium-severity vulnerability in Unlimited Elements For Elementor, classified under SQL Injection. CVSS score: 6.8/10. Published 2026-10-03.
How severe is CVE-2026-85568?: Medium severity. CVSS v3 base score is 6.8 out of 10.