Vulnerability · Published Jul 20, 2026 · Assigned by WPScan

CVE-2026-10081Unlimited Elements for Elementor < 2.0.11 - Unauthenticated Stored XSS via Google Reviews Widget

High 8.8

In plain English

A high-severity cross-site scripting in Unlimited Elements For Elementor from Unknown. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 43% of all known vulnerabilities).

Severity (CVSS 3.1)8.8High

Exploit odds (30 days)0.5%top 56.7% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

The Unlimited Elements For Elementor WordPress plugin before 2.0.11 does not sanitize or escape Google review content fetched from the Serp API before rendering it in the Google Reviews widget output, allowing unauthenticated attackers who submit a malicious review on the targeted business's Google listing to deliver Stored XSS to any visitor (including administrators) of any WP page displaying that Place ID's reviews.

Affected products (as reported)

Vendor	Product	Versions
Unknown	Unlimited Elements For Elementor	0 – before 2.0.11

Weakness: CWE-79 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

References

https://wpscan.com/vulnerability/e5cde405-5b34-4d3d-bfda-325402b0a5bc/ exploit, vdb-entry, technical-description