Unlimited Elements EUVD-2026-72643

Exploitation requires: (1) the target WordPress site has Unlimited Elements For Elementor installed and active in version <= 2.0.17; (2) an attacker can reach a plugin-handled input endpoint without any WordPress authentication (PR:N confirmed by CVSS vector); (3) a victim - most critically a logged-in WordPress administrator or privileged user - subsequently loads the page or Elementor element containing the injected payload (UI:R). The S:C scope change means impact propagates into the victim's browser session, enabling cookie theft or DOM manipulation beyond the plugin's own scope. Limiting factors: user interaction is mandatory with no drive-by path absent victim navigation, the plugin must be installed and active, and real-world severity scales with the privilege level of the victim user who loads the malicious content. No special non-default plugin configuration is described as required beyond the plugin being present and active.

The CVSS 7.1 base score is driven by network reachability (AV:N), low attack complexity (AC:L), no authentication requirement (PR:N), required user interaction (UI:R), and scope change (S:C) - a realistic profile for stored or reflected XSS in a widely deployed WordPress plugin. The mandatory user interaction (UI:R) is the principal real-world limiting factor: a victim, typically a logged-in WordPress administrator, must navigate to or load the page containing the injected payload before the script fires. EPSS data is not provided in the available intelligence, and the vulnerability is not listed in the CISA KEV catalog, indicating no confirmed mass exploitation at time of writing. Despite the absence of KEV listing and public exploit code, even a mid-sized municipal IT team in opole running public-facing WordPress installations should treat this as urgent given the zero-privilege entry point and the potential for full admin session compromise if a privileged user renders the malicious content. The A:L availability metric in the vendor-supplied CVSS vector is atypical for XSS and likely overstates actual availability impact; C:L and I:L are more firmly grounded in the XSS impact model.

An unauthenticated attacker identifies a WordPress site running Unlimited Elements For Elementor 2.0.17 or earlier, then submits a crafted XSS payload through an unsanitized plugin input - such as a widget configuration field or template parameter - accessible without login. When a WordPress administrator navigates to the affected page or post, the payload executes in their browser, exfiltrating the session cookie to an attacker-controlled endpoint and enabling full account takeover. No public proof-of-concept code has been identified at time of analysis, but the zero-privilege entry point and Patchstack disclosure lower the bar for independent rediscovery.