The Unlimited Elements for Elementor WordPress plugin prior to version 2.0.21 fails to escape an icon value before inserting it into an HTML attribute. Consequently, a user with Contributor privileges can store a malicious payload that will be executed when the page is rendered. The stored XSS allows the attacker to perform actions such as session hijacking, data theft, or defacement within the context of any visitor who views the affected page.

The vulnerability affects the Unlimited Elements for Elementor plugin for WordPress. All installations using a version older than 2.0.21 are impacted. The flaw is exploitable only by users with Contributor access, who do not possess the unfiltered_html capability.

Established CVSS and EPSS scores are not provided, and the CVE is not listed in the CISA KEV catalog, making the precise exploitation probability unclear. The stored XSS flaw is a high‑severity vulnerability; exploitation requires only that an attacker gains Contributor status or otherwise injects payloads through the plugin's widget parameter. Once injected, the payload will run under the context of any site visitor, potentially compromising user accounts and site integrity.