Unauthenticated Cross Site Scripting (XSS) in Unlimited Elements For Elementor (Free Widgets, Addons, Templates) <= 2.0.17 versions. (CVE-2026-84820)

CVE-2026-84820 is an unauthenticated Cross Site Scripting (XSS) vulnerability affecting Unlimited Elements For Elementor (Free Widgets, Addons, Templates) in versions up to 2.0.17. The vulnerability allows remote attackers to execute arbitrary scripts in the context of the affected application without requiring authentication. The CVSS 3.1 vector indicates the attack can be performed remotely with low complexity, no privileges required, but user interaction is needed. The impact includes partial confidentiality, integrity, and availability loss.

Successful exploitation of this vulnerability could allow an attacker to execute arbitrary scripts in the context of the affected application, potentially leading to data theft, session hijacking, or disruption of service. The CVSS score of 7.1 reflects high severity with impacts on confidentiality, integrity, and availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or patch links are currently provided. Until a patch is available, users should consider applying any recommended temporary mitigations from the vendor or restrict access to vulnerable components where possible.