The vulnerability allows unauthenticated attackers to embed malicious scripts in the title or description fields of RSS feed items. When an administrator adds the RSS Feed widget to a page and points it at an attacker‑controlled feed, the plugin fails to sanitize or escape these fields. The attacker’s payloads are then rendered as executable code on any visitor’s browser, enabling cookie theft, session hijack, or phishing.

Any WordPress installation with the Unlimited Elements for Elementor plugin version 2.0.26 or earlier that uses the RSS Feed widget to display a feed from a source the attacker can control is affected. The flaw resides in the plugin’s copy‑print logic that excludes raw printing for element content positions from its escaping workflow.

The CVSS score of 7.2 classifies this as high severity. Because the flaw is independent of authentication, an attacker can simply deliver a malicious RSS feed and any site visitor who loads the page will execute the script. The absence of an EPSS score and the fact that this entry is not listed in the CISA KEV catalog suggest that widespread exploitation has not yet been observed, but once a site is configured to consume an attacker‑controlled feed, the risk is imminent and significant.