The vulnerability is an improper neutralization of input during web page generation, allowing reflected cross-site scripting. An attacker can craft input that the plugin includes directly in an HTML response, causing arbitrary JavaScript to be executed in the browser of any visitor who loads the affected page.

Unlimited Elements For Elementor (Free Widgets, Addons, Templates) plugin versions up to and including 2.0.26 installed on WordPress sites are affected.

The CVSS score of 7.1 denotes a high severity vulnerability. The EPSS score is unavailable, and the issue is not listed in CISA’s KEV catalog, suggesting no publicly known widespread exploitation. The attack vector is reflected XSS: unsanitized input is reflected in the page response, providing an attacker with a path to inject and execute JavaScript on visitor browsers.