CVE-2026-75586: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in unitecms Unlimited Elements For Elementor

CVE-2026-75586 is a reflected cross-site scripting vulnerability in the Unlimited Elements For Elementor WordPress plugin affecting all versions up to and including 2.0.17. The flaw is due to improper neutralization of input during web page generation (CWE-79). Specifically, the 'formData[id]' parameter is not properly sanitized or escaped before being included verbatim in an exception message returned by a front-end AJAX handler. This handler is registered on the public 'wp' action without nonce, capability, or referer validation, enabling unauthenticated attackers to inject malicious scripts that execute in the context of the victim's browser when the response is served as text/html.

An unauthenticated attacker can exploit this vulnerability to inject and execute arbitrary JavaScript in the context of a victim's browser. This can lead to limited confidentiality and integrity impacts such as theft of user session data or manipulation of page content. The CVSS score of 6.1 reflects a medium severity with network attack vector, low attack complexity, no privileges required, user interaction required, and partial impact on confidentiality and integrity.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider disabling or restricting access to the affected AJAX functionality or applying custom input validation and output escaping as a temporary mitigation. Monitoring vendor channels for updates is recommended.