CVE-2026-2724 is a stored cross-site scripting vulnerability in the Unlimited Elements for Elementor WordPress plugin. The issue arises from insufficient input sanitization and output escaping on form submission data displayed in the admin Form Entries Trash view. This allows unauthenticated attackers to inject arbitrary web scripts that execute in the context of an administrator's browser when viewing trashed form entries. The vulnerability affects all versions up to and including 2.0.5. It has a CVSS 3.1 base score of 7.2, indicating high severity, with network attack vector, low attack complexity, no privileges required, no user interaction, and impacts confidentiality and integrity with no availability impact.

Successful exploitation allows an unauthenticated attacker to execute arbitrary scripts in the administrator's browser context when viewing the trashed form entries. This can lead to partial confidentiality and integrity compromise of the administrator's session or data accessible via the admin interface. There is no direct impact on availability. No known exploits in the wild have been reported to date.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, administrators should avoid viewing the Form Entries Trash view or restrict access to trusted users only. Monitoring vendor channels for updates or patches is recommended.