CVE-2024-45454 is a reflected cross-site scripting vulnerability in the Unlimited Elements For Elementor plugin (Free Widgets, Addons, Templates) affecting versions up to 1.5.121. The issue is due to improper neutralization of input during web page generation, which allows attackers to inject malicious scripts that execute when a user views a crafted page. The vulnerability has a CVSS 3.1 base score of 7.1 (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L), indicating it is exploitable remotely without privileges but requires user interaction. This can lead to partial compromise of confidentiality, integrity, and availability of the affected system. No patch or official fix information is currently available.

Successful exploitation of this vulnerability could allow an attacker to execute arbitrary scripts in the context of the victim's browser, potentially leading to data theft, session hijacking, or other malicious actions affecting confidentiality, integrity, and availability. The vulnerability is remotely exploitable without authentication but requires user interaction. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider limiting exposure by restricting access to the affected plugin or disabling it if feasible. Monitor vendor channels for updates and apply patches promptly once available.