The vulnerability is a reflected Cross‑Site Scripting flaw where unsanitized input is included in generated web pages. An attacker can craft a URL or input that triggers the plugin to output malicious JavaScript, which will execute in the browsers of any users visiting the affected page. This could lead to session hijacking, credential theft, defacement, or the delivery of malware by exploiting the victim’s privileges.

WordPress sites running the Unlimited Elements For Elementor (Free Widgets, Addons, Templates) plugin up to and including version 2.0.24 are affected. Any site that has installed this plugin during its lifecycle up to that release is vulnerable.

The CVSS score of 7.1 indicates a moderate‑to‑high risk. The EPSS score is not available, so the precise exploitation probability is unknown, but the absence from the KEV catalog suggests no widely known active exploitation. Based on the description, the likely attack vector is remote via a crafted request or link that causes the plugin to echo unsanitized data. If an attacker can embed a malicious script into a page that a logged‑in admin or site visitor accesses, the script will run with the victim’s browser privileges.