# cve.now: Unitecms

The newest entries naming Unitecms as an affected vendor (up to 200), of 33 in all, 0 known exploited. Older ones are in the full catalog at https://cve.now/latest.md.

- [CVE-2026-116558](https://cve.now/CVE-2026-116558.md): Unlimited Elements for Elementor \<= 2.0.26 - Unauthenticated Stored Cross-Site Scripting via RSS Feed Widget (CVSS 7.2)
- [CVE-2026-18561](https://cve.now/CVE-2026-18561.md): Unlimited Elements For Elementor \<= 2.0.16 - Unauthenticated SQL Injection (CVSS 7.5)
- [CVE-2026-77150](https://cve.now/CVE-2026-77150.md): Unlimited Elements For Elementor \<= 2.0.16 - Reflected Cross-Site Scripting (CVSS 6.1)
- [CVE-2026-75586](https://cve.now/CVE-2026-75586.md): Unlimited Elements For Elementor \<= 2.0.17 - Reflected Cross-Site Scripting via 'formData\[id\]' Parameter (CVSS 6.1)
- [CVE-2026-5486](https://cve.now/CVE-2026-5486.md): Unlimited Elements For Elementor \<= 2.0.7 - Authenticated (Contributor+) SQL Injection via 'filter\_search' Parameter (CVSS 6.5)
- [CVE-2024-13362](https://cve.now/CVE-2024-13362.md): Freemius \<= 2.10.1 - Reflected DOM-Based Cross-Site Scripting via url Parameter (CVSS 6.1)
- [CVE-2026-4659](https://cve.now/CVE-2026-4659.md): Unlimited Elements For Elementor \<= 2.0.6 - Authenticated (Contributor+) Arbitrary File Read via Path Traversal in Repeater JSON/CSV URL with Path Traversal (CVSS 7.5)
- [CVE-2026-2724](https://cve.now/CVE-2026-2724.md): Unlimited Elements For Elementor \<= 2.0.5 - Unauthenticated Stored Cross-Site Scripting via Form Entry Fields (CVSS 7.2)
- [CVE-2025-14274](https://cve.now/CVE-2025-14274.md): Unlimited Elements for Elementor \<= 2.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Border Hero Widget (CVSS 5.4)
- [CVE-2025-14476](https://cve.now/CVE-2025-14476.md): Doubly \<= 1.0.46 - Authenticated (Subscriber+) PHP Object Injection via ZIP File Import (CVSS 8.8)
- [CVE-2025-13692](https://cve.now/CVE-2025-13692.md): Unlimited Elements For Elementor and Unlimited Elements For Elementor (Premium) \<= 2.0 - Unauthenticated Stored Cross-Site Scripting via SVG File Upload (CVSS 7.2)
- [CVE-2025-8603](https://cve.now/CVE-2025-8603.md): Unlimited Elements For Elementor \<= 1.5.148 - Authenticated (Contributor+) Stored Cross-Site Scripting (CVSS 6.4)
- [CVE-2025-1663](https://cve.now/CVE-2025-1663.md): Unlimited Elements For Elementor \<= 1.5.142 - Authenticated (Contributor+) Stored Cross-Site Scripting (CVSS 6.4)
- [CVE-2024-13155](https://cve.now/CVE-2024-13155.md): Unlimited Elements For Elementor (Free Widgets, Addons, Templates) \<= 1.5.140 - Authenticated (Contributor+) Stored Cross-Site Scripting via Transparent Split Hero Widget (CVSS 6.4)
- [CVE-2024-13153](https://cve.now/CVE-2024-13153.md): Unlimited Elements For Elementor (Free Widgets, Addons, Templates) \<= 1.5.135 - Authenticated (Contributor+) Stored Cross-Site Scripting via Multiple Widgets (CVSS 6.4)
- [CVE-2024-10784](https://cve.now/CVE-2024-10784.md): Unlimited Elements For Elementor (Free Widgets, Addons, Templates) \<= 1.5.126 - Authenticated (Contributor+) Stored Cross-Site Scripting (CVSS 6.4)
- [CVE-2022-4974](https://cve.now/CVE-2022-4974.md): Freemius SDK \<= 2.4.2 - Missing Authorization Checks (CVSS 6.3)
- [CVE-2024-6315](https://cve.now/CVE-2024-6315.md): Blox Page Builder \<= 1.0.65 - Authenticated (Contributor+) Arbitrary File Upload (CVSS 8.8)
- [CVE-2024-6169](https://cve.now/CVE-2024-6169.md): Unlimited Elements For Elementor (Free Widgets, Addons, Templates) \<= 1.5.112 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'username' (CVSS 6.4)
- [CVE-2024-6170](https://cve.now/CVE-2024-6170.md): Unlimited Elements For Elementor (Free Widgets, Addons, Templates) \<= 1.5.112 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'email' (CVSS 6.4)
- [CVE-2024-6166](https://cve.now/CVE-2024-6166.md): Unlimited Elements For Elementor (Free Widgets, Addons, Templates) \<= 1.5.112 - Authenticated (Contributor+) Time-Based SQL Injection (CVSS 8.8)
- [CVE-2024-6171](https://cve.now/CVE-2024-6171.md): Unlimited Elements For Elementor (Free Widgets, Addons, Templates) \<= 1.5.112 - IP Address Spoofing to Antispam Bypass (CVSS 5.3)
- [CVE-2024-5329](https://cve.now/CVE-2024-5329.md): Unlimited Elements For Elementor (Free Widgets, Addons, Templates) \<= 1.5.109 - Authenticated (Contributor+) Blind SQL Injection via data\[addonID\] Parameter (CVSS 8.8)
- [CVE-2024-3190](https://cve.now/CVE-2024-3190.md): Unlimited Elements For Elementor (Free Widgets, Addons, Templates) \<= 1.5.107 - Authenticated (Contributor+) Stored Cross-Site Scripting via Text Field (CVSS 5.4)
- [CVE-2023-6743](https://cve.now/CVE-2023-6743.md): Unlimited Elements for Elementor \<= 1.5.89 - Authenticated(Contributor+) Remote Code Execution via template import (CVSS 8.8)
- [CVE-2024-4779](https://cve.now/CVE-2024-4779.md): Unlimited Elements for Elementor \<= 1.5.107 - Authenticated (Contributor+) SQL Injection via data\[post\_ids\]\[0\] (CVSS 8.8)
- [CVE-2024-3055](https://cve.now/CVE-2024-3055.md): Unlimited Elements For Elementor (Free Widgets, Addons, Templates) \<= 1.5.102 - Authenticated (Contributor+) SQL Injection (CVSS 8.8)
- [CVE-2024-3547](https://cve.now/CVE-2024-3547.md): Unlimited Elements For Elementor (Free Widgets, Addons, Templates) \<= 1.5.102 - Reflected Cross-Site Scripting (CVSS 6.1)
- [CVE-2024-2662](https://cve.now/CVE-2024-2662.md): Unlimited Elements For Elementor (Free Widgets, Addons, Templates) \<= 1.5.102 - Authenticated (Admin+) Command Injection (CVSS 7.2)
- [CVE-2024-0367](https://cve.now/CVE-2024-0367.md): Unlimited Elements For Elementor \<= 1.5.96 - Authenticated (Contributor+) Stored Cross-Site Scripting via Widget Link (CVSS 6.4)
- [CVE-2024-1710](https://cve.now/CVE-2024-1710.md): Addon Library \<= 1.3.76 - Missing Authorization to Authenticated (Subscriber+) Arbitrary File Upload (CVSS 8.8)
- [CVE-2023-6925](https://cve.now/CVE-2023-6925.md): Unlimited Addons for WPBakery Page Builder \<= 1.0.42 - Authenticated (Editor+) Arbitrary File Upload (CVSS 7.2)
- [CVE-2023-3295](https://cve.now/CVE-2023-3295.md): Unlimited Elements For Elementor (Free Widgets, Addons, Templates) \<= 1.5.66 - Authenticated (Contributor+) Arbitrary File Upload (CVSS 8.8)

---

Source: cve.now
Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards.
Page: https://cve.now/vendors/unitecms
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.