The Unlimited Elements For Elementor plugin for WordPress has a security issue that allows hackers to inject harmful code through a link in a widget called ‘Button Link’. This can happen in all versions up to 1.5.96 because the plugin does not properly filter and protect against user inputs. This means that attackers with a certain level of access can add their own code to a page, which will run whenever someone opens that page.