High severity · published Jul 20, 2026
CVE-2026-10081
Unlimited Elements for Elementor < 2.0.11 - Unauthenticated Stored XSS via Google Reviews Widget
8.8
CVSS
0.5%
EPSS
No
On KEV
Description
The Unlimited Elements For Elementor WordPress plugin before 2.0.11 does not sanitize or escape Google review content fetched from the Serp API before rendering it in the Google Reviews widget output, allowing unauthenticated attackers who submit a malicious review on the targeted business's Google listing to deliver Stored XSS to any visitor (including administrators) of any WP page displaying that Place ID's reviews.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
Required
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.5% · higher than 43% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
UE
Unlimited Elements For Elementor ·
before 2.0.11 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-10081
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-10081
wpscan.com
https://wpscan.com/vulnerability/e5cde405-5b34-4d3d-bfda-325402b0a5bc/
More from Unlimited Elements For Elementor
7.5
CVE-2026-85017
Unlimited Elements For Elementor < 2.0.20 - Subscriber+ PHP Object Injection
6.8
CVE-2026-85568
Unlimited Elements For Elementor 1.5.139 - 2.0.20 - Unauthenticated SQLi via 'ucs' Parameter
6.8
CVE-2026-85016
Unlimited Elements For Elementor < 2.0.21 - Contributor+ Stored XSS via Icon Library Parameter
6.6
CVE-2026-85015
Unlimited Elements For Elementor < 2.0.21 - Authenticated Arbitrary File Write via Path Traversal
6.3
CVE-2026-92923
Unlimited Elements For Elementor 1.5.142 - 2.0.20 - Subscriber+ SQLi via get_addon_output_data