The Unlimited Elements for Elementor WordPress plugin before version 2.0.21 does not escape the icon value before incorporating it into an HTML attribute. This flaw allows a user with Contributor privileges, who lacks the unfiltered_html capability, to store a malicious payload. When the affected page is rendered, the stored script executes in the browser context of any visitor, enabling possible session hijacking, data theft, or site defacement.

All installations of the Unlimited Elements for Elementor plugin for WordPress running a version older than 2.0.21 are vulnerable. The issue is exploitable only by users assigned the Contributor role without the unfiltered_html capability.

The CVSS score of 6.8 indicates moderate severity, and the EPSS score of < 1% indicates a low likelihood of exploitation. The vulnerability is not listed in the CISA KEV catalog. The vulnerability requires only local access to a Contributor account; no external network exploitation is needed. Once an attacker injects the payload, it runs under the context of every site visitor, compromising confidentiality and integrity of the site.