The Unlimited Elements For Elementor plugin contains insufficient input sanitization and output escaping in several widgets, allowing authenticated users with Contributor‑level access or higher to store malicious scripts in pages. When an affected page is viewed, the embedded script runs in the victim's browser, enabling session hijacking, credential theft, or defacement. The flaw is a classic stored XSS and is identified as CWE‑79.

WordPress sites using the UniteCMS Unlimited Elements For Elementor plugin, versions 1.5.142 and earlier, are affected. The plugin runs as a WordPress extension and is publicly available from the WordPress plugin repository.

The CVSS score of 6.4 indicates moderate severity, while the EPSS score of less than 1% points to a very low likelihood of exploitation at the time of analysis. The flaw is not listed in CISA’s Known Exploited Vulnerabilities catalog. Exploitation requires that the attacker be able to authenticate to the WordPress backend with at least Contributor privileges, after which they can insert a malicious payload into a page or widget that will be served to all site visitors. Because the attack vector is limited to authenticated users, the risk is contained to sites that have exposed WordPress admin access.