CVE-2026-103344: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in Unlimited Elements Unlimited Elements For Elementor (Free Widgets, Addons, Templates)

The vulnerability identified as CVE-2026-103344 in Unlimited Elements For Elementor (Free Widgets, Addons, Templates) is a reflected cross-site scripting (XSS) flaw. It arises from improper neutralization of input during web page generation, allowing malicious input to be reflected back to users without adequate sanitization. This can lead to execution of arbitrary scripts in the victim's browser. The affected versions include all releases prior to 2.0.21.

Successful exploitation of this vulnerability could allow an attacker to execute arbitrary scripts in the context of the victim's browser session, potentially leading to information disclosure, session hijacking, or other client-side impacts. The CVSS score of 7.1 (high severity) reflects the network attack vector, low attack complexity, no privileges required, user interaction required, and impacts on confidentiality, integrity, and availability.

No explicit patch or remediation details are provided in the input data. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Users should monitor for updates from Unlimited Elements and apply any official fixes once available. Until then, consider limiting exposure to untrusted input and user interactions that could trigger the vulnerability.