A cross-site scripting vulnerability in the Unlimited Elements For Elementor WordPress plugin allows attackers to execute malicious scripts, potentially compromising user sessions and data.

This plugin is affected by a cross-site scripting vulnerability, categorized as CWE-79. The vulnerability is triggered via user interaction and does not require authentication, allowing an unauthenticated attacker to impact the system.

With a CVSS score of 8.8, this vulnerability is critical for web-based applications. Exploitation can lead to session hijacking, defacement of the website, or the redirection of users to malicious third-party sites, causing significant reputational and operational damage.

Immediate Action: Update the Unlimited Elements For Elementor plugin to version 2.0.11 or later immediately.

Proactive Monitoring: Monitor site logs for unusual URL parameters or attempts to inject script tags into common input fields.

Compensating Controls: Utilize a Web Application Firewall (WAF) with updated rulesets to detect and block common XSS attack vectors targeted at WordPress plugins.

Public Exploit Available: No

Given the availability of a proof-of-concept and the high CVSS score, it is imperative to update the plugin to the patched version without delay. Failure to apply this update leaves the site vulnerable to automated exploitation attempts that could compromise administrative or user accounts.