The Unlimited Elements for Elementor plugin stores data submitted through its form fields and later displays that data in the admin Trash view without sufficient input sanitization or output escaping. This flaw is a classic stored cross‑site scripting vulnerability (CWE‑79). When a malicious actor submits a form containing crafted scripts, those scripts remain hidden until an administrator opens the trash view, where they are rendered and executed in the administrator’s browser. The impact includes credential theft, defacement, or launching further attacks against the site.

WordPress sites that have the Unlimited Elements for Elementor plugin in any version up to and including 2.0.5 are affected. The plugin is provided by the vendor unitecms under the product name Unlimited Elements For Elementor. No other WordPress core versions or plugins are impacted according to the current data.

The vulnerability has a CVSS score of 7.2, indicating high severity, and an EPSS score below 1%, suggesting a relatively low probability of exploitation in the general ecosystem. The likely attack vector is unauthenticated submission of a malicious form entry, followed by authenticated viewing of the trash view by an administrator. The flaw is not listed in the CISA KEV catalog. Despite the low exploitation likelihood, the high potential impact warrants a high‑priority response.