This vulnerability in Unlimited Elements For Elementor (Free Widgets, Addons, Templates) arises from improper input neutralization during web page generation, leading to reflected cross-site scripting (XSS). The issue affects all versions up to and including 2.0.12. The CVSS 3.1 vector indicates the vulnerability is remotely exploitable over the network without privileges and requires user interaction, with a scope change and impacts on confidentiality, integrity, and availability. No vendor advisory or patch information is provided, and no known exploits have been observed.

Successful exploitation could allow an attacker to execute arbitrary scripts in the context of the affected website, potentially leading to information disclosure, modification of site content, or disruption of availability. The reflected XSS requires user interaction and can affect confidentiality, integrity, and availability of the affected system.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, consider applying input validation or output encoding workarounds if feasible. Monitor vendor channels for updates and apply patches promptly once released.