Unlimited Elements For Elementor Stored Cross-Site Scripting Vulnerability

A stored cross-site scripting vulnerability has been identified in the Unlimited Elements For Elementor plugin for WordPress, specifically in the Transparent Split Hero widget. This vulnerability exists in all versions prior to 1.5.140 and allows authenticated attackers with contributor-level access or higher to inject arbitrary scripts. The injected scripts are executed when a user accesses the affected page. The vulnerability arises from inadequate input sanitization and output escaping of user-supplied attributes.

Impact

Exploitation of this vulnerability allows for stored cross-site scripting, where injected scripts are executed in the context of the user viewing the page.

Remediation

To address this vulnerability, users should update to version 1.5.141 or a newer patched version. After updating, the affected Transparent Split Hero widget must be manually deleted and reinstalled.