The Unlimited Elements For Elementor plugin for WordPress suffers from a stored XSS vulnerability (CWE-79) in the 'Tile Gallery' widget due to improper neutralization of input during web page generation. Authenticated attackers with Contributor-level privileges or above can inject arbitrary scripts that persist in the plugin's data and execute in the context of users viewing the compromised pages. This vulnerability affects all plugin versions up to 1.5.126. The CVSS 3.1 base score is 6.4, reflecting network attack vector, low attack complexity, privileges required, no user interaction, and impacts on confidentiality and integrity with no availability impact. There is no vendor advisory or patch information available at this time.

Successful exploitation allows an authenticated user with Contributor or higher privileges to inject malicious scripts that execute in the browsers of users who visit the affected pages. This can lead to unauthorized disclosure of information and modification of content within the context of the vulnerable site. There is no indication of availability impact or known active exploitation in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict Contributor-level access and above to trusted users only. Consider disabling or avoiding use of the 'Tile Gallery' widget if possible. Monitor official vendor channels for updates and apply patches promptly once released.