Unlimited Elements EUVD-2026-112067

Exploitation requires an attacker to deliver a crafted request/URL to a victim and for that victim to interact with it (UI:R in the CVSS vector), making this dependent on social engineering rather than silent remote compromise. The affected component is the Unlimited Elements For Elementor plugin at versions up to and including 2.0.24 running on a WordPress site. The specific parameter, page, or feature that reflects the unsanitized input is not described in the available sources. No authentication is needed (PR:N), but the mandatory user-interaction requirement and the dependence on luring a victim are the primary factors limiting real-world exploitation.

This is a reflected cross-site scripting flaw (CWE-79) in the Unlimited Elements For Elementor WordPress plugin, affected from an unspecified version through 2.0.24. The input CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L, base 7.1) indicates a network-reachable, low-complexity attack requiring no attacker privileges (PR:N, unauthenticated) but mandatory user interaction (UI:R) - meaning a victim must be lured into clicking a crafted link or visiting a malicious page. The scope change (S:C) reflects script execution crossing from the vulnerable application into the victim's browser session. No EPSS score, CISA KEV listing, SSVC exploitation/automatable/technical-impact values, or verified public exploit code were provided in the input, so the real-world exploitation likelihood cannot be quantified from the data at hand. The only decision signal is vuln.today's 'this_week' priority and the fact it was reported by Patchstack, a WordPress-focused research vendor; there is no indication of active exploitation. Net assessment: a moderate-severity, interaction-dependent reflected XSS typical of the large volume of WordPress plugin advisories - worth patching on a normal remediation cadence rather than an emergency, and its practical impact is bounded by the need for social engineering and the low (not high) confidentiality/integrity impact. Note the UI:R and A:L in the input are not explained by any described trigger mechanism; the underlying injection sink is not detailed in the available sources.

An attacker crafts a URL for an affected site containing a malicious script payload in a parameter that the plugin reflects unsanitized into a generated web page, then sends it to a target (e.g., a logged-in administrator) via email or a link. When the victim clicks it, the script executes in their browser in the site's context, allowing session/cookie theft or actions on the victim's behalf. No public, verified working exploit code is identified in the provided input; the only reference is a Patchstack database entry.