The vulnerability CVE-2026-103342 in Unlimited Elements For Elementor (Free Widgets, Addons, Templates) is a reflected cross-site scripting (XSS) flaw caused by improper input neutralization during web page generation. This allows an attacker to craft malicious input that, when reflected in the web page, executes arbitrary scripts in the victim's browser session. The affected versions include all versions from the initial release up to 2.0.20 inclusive. The CVSS 3.1 base score is 7.1, indicating a high severity with network attack vector, low attack complexity, no privileges required, user interaction required, and impacts on confidentiality, integrity, and availability.

Successful exploitation of this vulnerability can lead to execution of arbitrary scripts in the context of the affected web application, potentially allowing attackers to steal sensitive information, hijack user sessions, or perform actions on behalf of the user. The reflected nature of the XSS requires user interaction, such as clicking a crafted link. The vulnerability impacts confidentiality, integrity, and availability to a limited extent.

No explicit patch or remediation information is provided in the input data. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, users should consider applying standard XSS mitigations such as input validation and output encoding if possible, and avoid clicking suspicious links related to the affected plugin.