The vulnerability arises from improper neutralization of user‑supplied input when the Unlimited Elements For Elementor plugin constructs web pages, leading to a reflected XSS flaw. Malicious input can be crafted so that it is echoed back into the page’s HTML, allowing the attacker to execute arbitrary code in the victim’s browser. Such code execution could be used to steal session cookies, deface the site, or redirect users to phishing pages.

WordPress sites that have the Unlimited Elements For Elementor (Free Widgets, Addons, Templates) plugin installed in any version up to and including 2.0.20 are vulnerable. Versions 2.0.21 and later contain the fix and are not affected.

The CVSS base score of 7.1 indicates a moderate to high severity. The EPSS score is not available, implying that public exploitation data is limited. The vulnerability is not listed in the CISA KEV catalog. The attack vector is inferred to be remote via a reflected XSS flaw; based on the description of improper neutralization of input during web page generation, an attacker would need to entice a user to visit a crafted URL or a page that renders the malicious input, resulting in execution of arbitrary script within the victim’s browser context without providing full site‑wide control.