The vulnerability is a stored cross‑site scripting flaw that arises from improper neutralization of user input in the Unlimited Elements For Elementor plugin. Malicious input can be persisted in widget or template content and later rendered in a web page, giving an attacker the ability to run arbitrary JavaScript in the browsers of site visitors or logged‑in administrators. This can lead to session hijacking, defacement, or the delivery of malware, depending on the attacker’s objectives. The weakness is classified under CWE‑79, which covers XSS issues.

The plugin Unlimited Elements For Elementor (Free Widgets, Addons, Templates) is affected in all released versions up to and including 2.0.26. The risk applies to any WordPress installation that has this plugin installed and has not yet been updated to 2.0.28 or later.

The CVSS score of 6.5 indicates a medium severity, and while an EPSS score is not available, the fact that the flaw is a stored XSS increases the likelihood of real‑world exploitation, especially on sites that rely on the plugin for content creation. The vulnerability is not listed in CISA’s KEV catalog, but that does not reduce its risk. An attacker who can add or edit content—typically through an administrator or editor role—can embed malicious code that persists across page loads and affects all site users. Given the nature of the flaw, even non‑authenticated users can be impacted if the injected scripts execute in their browsers.