The Unlimited Elements For Elementor plugin contains a stored cross‑site scripting flaw in its handling of SVG file uploads. The lack of proper input sanitization and output escaping lets an attacker embed malicious JavaScript inside an SVG. When users view or download the compromised SVG, the code runs in the visitor’s browser, exposing the site to data theft, cookie hijacking, or further compromise. The weakness is categorized as CWE‑79.

Both the free and premium editions of the UniteCMS Unlimited Elements For Elementor plugin are affected for all releases up to and including version 2.0. Any WordPress installation that relies on these editions and has a form with an SVG upload field is vulnerable. The flaw exists in the processing logic within the form handling component of the plugin.

The vulnerability carries a CVSS score of 7.2, denoting a high impact risk, yet the EPSS score is less than 1 %, indicating a very low probability of exploitation in the wild. The flaw is not listed in the CISA KEV catalog. An attacker can exploit the issue without authentication by uploading a crafted SVG through an existing form. Once stored, the script executes for every user who accesses the SVG, even after the premium plugin is deactivated or removed.