CVE-2024-29792 describes a cross-site scripting vulnerability in the Unlimited Elements For Elementor plugin (Free Widgets, Addons, Templates) for WordPress, affecting versions up to 1.5.93. The issue is due to improper neutralization of input during web page generation, which can allow an attacker to inject and execute malicious scripts. The CVSS v3.1 base score is 7.1, indicating high severity, with network attack vector, low attack complexity, no privileges required, user interaction required, scope changed, and impacts on confidentiality, integrity, and availability at low to low levels. No patch or remediation information is currently provided by the vendor.

Successful exploitation of this vulnerability could allow an attacker to execute arbitrary scripts in the context of users visiting a compromised or maliciously crafted page using the affected plugin. This may lead to partial disclosure of sensitive information, modification of data, or disruption of availability related to the plugin's functionality. However, no known exploits are reported in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a patch is available, users should consider limiting exposure by restricting access to affected plugin features or disabling the plugin if feasible. Monitor official Unlimited Elements communications for updates and apply any official fixes promptly once released.