CVE-2026-77150 is a reflected XSS vulnerability in the Unlimited Elements For Elementor WordPress plugin affecting all versions up to 2.0.16. The flaw exists because the 'data[name]' parameter is not properly sanitized or escaped before being used in web page generation. The vulnerable AJAX action 'show_preview' is accessible without authentication and relies solely on a nonce for protection, which attackers can retrieve from publicly accessible pages. This enables attackers to inject malicious scripts that execute in the context of users who interact with crafted links, potentially leading to session hijacking or other client-side impacts.

An unauthenticated attacker can exploit this vulnerability to inject and execute arbitrary JavaScript in the browsers of users who click on maliciously crafted links. This can lead to information disclosure such as session tokens or other sensitive data accessible via the browser, and potentially other client-side impacts. The vulnerability does not allow direct server compromise or denial of service but poses a risk to user confidentiality and integrity.

No official patch or fix is currently documented. Users should check the vendor advisory for updates. Until a fix is available, avoid exposing the vulnerable AJAX action to unauthenticated users or implement additional access controls. Users should also be cautious about clicking on untrusted links that could exploit this vulnerability.