Unlimited Elements EUVD-2026-43371

Exploitation requires the attacker to induce a victim to open a maliciously crafted request/link (UI:R in the CVSS vector), so it is not self-propagating and cannot be triggered without human interaction. No authentication is required by the attacker to forge the payload (PR:N), and the target must be running Unlimited Elements For Elementor version 2.0.12 or earlier on a WordPress site reachable by the victim. The primary limiting factors are the mandatory click/interaction, the fact that impact is scoped to the victim's own browser session rather than direct server compromise, and that maximum leverage is achieved when the lured victim is a privileged/administrative user.

Signals are moderate and internally consistent rather than alarming. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L = 7.1 High) indicates network-reachable, low-complexity, unauthenticated exploitation, but the mandatory user interaction (UI:R) and only Low impact on each dimension temper real-world severity - this is typical reflected-XSS scoring where the scope change (S:C) is what pushes it into High territory. No EPSS score was supplied in the input, so exploitation probability cannot be quantified here. The vulnerability is NOT in CISA KEV and no POC or SSVC decision data was provided, so there is no evidence of active or automatable exploitation. Net assessment: a legitimate patch-worthy issue for exposed WordPress sites, but a lower operational priority than a stored XSS or an unauthenticated RCE, because it depends on social-engineering a victim into clicking a crafted link.

An attacker crafts a URL targeting a vulnerable plugin endpoint on a victim WordPress site, embedding a malicious JavaScript payload in a reflected request parameter, and delivers it via phishing email or a malicious link. When an authenticated administrator or any logged-in user clicks the link, the script executes in their browser under the site's origin, enabling session/cookie theft, admin-action forgery, or redirection. No public exploit code has been identified at time of analysis, and low attack complexity (AC:L) means a working payload is straightforward once the injectable parameter is known.