Unitecms · weakness class

SQL Injection

6 CVEs

Every dot is a CVE in what this vendor ships; the named ones are the most at risk.

Every one of the 6 is a mark on the map. Named now: 1 to 6, most at risk first.

Unlimited Elements For Elementor (Free Widgets, Addons, Templates) <= 1.5.102 - Authenticated (Contributor+) SQL InjectionCVE-2024-3055unitecms · CVSS 8.8 · 0.8% likely
CWE-89
Unlimited Elements For Elementor <= 2.0.16 - Unauthenticated SQL InjectionCVE-2026-18561unitecms · CVSS 7.5 · 0.6% likely
CWE-89
Unlimited Elements For Elementor (Free Widgets, Addons, Templates) <= 1.5.109 - Authenticated (Contributor+) Blind SQL Injection via data[addonID] ParameterCVE-2024-5329unitecms · CVSS 8.8 · 0.5% likely
CWE-89
Unlimited Elements For Elementor (Free Widgets, Addons, Templates) <= 1.5.112 - Authenticated (Contributor+) Time-Based SQL InjectionCVE-2024-6166unitecms · CVSS 8.8 · 0.5% likely
CWE-89
Unlimited Elements For Elementor <= 2.0.7 - Authenticated (Contributor+) SQL Injection via 'filter_search' ParameterCVE-2026-5486unitecms · CVSS 6.5 · 0.5% likely
CWE-89
Unlimited Elements for Elementor <= 1.5.107 - Authenticated (Contributor+) SQL Injection via data[post_ids][0]CVE-2024-4779unitecms · CVSS 8.8 · 0.5% likely
CWE-89

exploited in the wildcheck availableringed, named or not: CyberSIXT has reported on it

Zoom in on the map and the dots under the middle of it are named where they are.

Data as of 2026-11-15. CVE List through 2026-11-15 · EPSS of 2026-11-14 · CISA KEV checked 2026-11-15. Sources: the CVE List, CISA KEV, EPSS, NVD, nuclei templates and public bug bounty data.