CVE-2024-3547 describes a reflected cross-site scripting vulnerability in the Unlimited Elements For Elementor plugin for WordPress. The issue arises from insufficient sanitization and escaping of the 'google_connect_error' parameter, allowing attackers to inject malicious scripts. This vulnerability affects all plugin versions up to and including 1.5.102. Successful exploitation requires tricking a user into clicking a crafted link, leading to script execution in the user's browser context.

An attacker can execute arbitrary scripts in the context of the affected website by exploiting the reflected XSS vulnerability. This can lead to limited confidentiality and integrity impacts, such as session hijacking or defacement, but does not affect availability. The vulnerability requires user interaction and no privileges are needed to exploit it.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider disabling or restricting use of the affected plugin or applying web application firewall rules to block malicious input targeting the 'google_connect_error' parameter. Monitor vendor channels for updates and apply patches promptly once released.