Unlimited Elements for Elementor EUVD-2026-116776

Exploitation requires the attacker to deliver a crafted URL whose parameter is reflected without neutralization into the plugin-generated web page, and requires a victim to actively open that link (UI:R) in a browser - ideally an authenticated site user or administrator for maximum impact. The affected component is the Unlimited Elements For Elementor WordPress plugin at versions from n/a through 2.0.26 running on a WordPress site, so WordPress with this plugin installed and reachable is a prerequisite. The precise vulnerable parameter, endpoint, or feature is not described in the available sources. Limiting factors: the dependence on victim interaction prevents fully automated server-side compromise, and impact is confined to the browser/site origin (C:L/I:L/A:L); the specific input vector is unverified.

This is a reflected cross-site scripting flaw (CWE-79) scored CVSS 7.1 with vector CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L, meaning network-reachable, low-complexity, no privileges required, but dependent on victim interaction (UI:R) and with a scope change (S:C) reflecting execution in the victim's browser context rather than the server. The real-world risk signals are mixed and point to a moderate, not emergency, priority: there is no CISA KEV listing (not confirmed actively exploited), no EPSS score was supplied in the input, and no verified working exploit code is referenced - only a Patchstack advisory entry. The vuln.today decision label is 'this_week', consistent with a remotely reachable unauthenticated XSS in a widely used plugin but short of 'act_now'/'emergency'. Reflected XSS fundamentally requires an attacker to lure a victim into clicking a crafted link, which materially limits mass automated exploitation compared to stored or unauthenticated-RCE issues, so the 7.1 is a genuine but interaction-gated risk rather than a high-CVSS-but-illusory one. EPSS is missing from the input, so probability-of-exploitation cannot be quantified here; this should be verified against the live EPSS feed before final triage.

An attacker crafts a malicious URL targeting the vulnerable plugin endpoint with a payload that is reflected unsanitized into the generated page, then delivers it to a logged-in site user or administrator via phishing, a comment, or a malicious ad. When the victim opens the link in their authenticated browser session, the injected script executes in the site's origin, enabling session/cookie theft, actions on the victim's behalf, or admin-panel manipulation. No public working exploit code is referenced, and successful exploitation depends on the victim clicking the attacker-supplied link (UI:R).