CVE-2026-10081
HighCVSS 8.8Exploitation Probability (EPSS)
Low risk20th percentile - higher than 20% of all known CVEs
Summary
The Unlimited Elements For Elementor WordPress plugin before version 2.0.11 does not sanitize Google review content from the Serp API before rendering it in the Google Reviews widget. This allows unauthenticated attackers to inject stored XSS via a malicious review on the business's Google listing.
Risk Assessment
Any visitor to a WordPress page displaying reviews for that place can be attacked, including administrators, potentially leading to account takeover and further site compromise.
Recommendation
Update the Unlimited Elements For Elementor plugin to version 2.0.11 or later, which includes proper data sanitization.
Other vulnerabilities in Unlimited Elements For Elementor
See all- CVE-2026-103341Medium
Unlimited Elements For Elementor plugin has a missing authorization vulnerability, allowing exploitation of incorrectly configured access control levels. Affects versions up to 2.0.20.
- CVE-2026-103338High
The Unlimited Elements For Elementor (Free Widgets, Addons, Templates) WordPress plugin contains an SQL Injection (Blind SQL Injection) vulnerability caused by improper neutralization of special elements in SQL commands. The issue affects versions from n/a through 2.0.20.
- CVE-2026-66608Medium
The Unlimited Elements For Elementor plugin in versions up to and including 2.0.19 contains a Server Side Request Forgery (SSRF) vulnerability. A user with Contributor privileges can force the server to make requests to arbitrary resources.
- CVE-2026-103355Critical
The Unlimited Elements For Elementor plugin up to version 2.0.20 contains a blind SQL injection vulnerability. An attacker can exploit this flaw to manipulate database queries without knowing the database structure.
- CVE-2026-95534High
The Unlimited Elements For Elementor WordPress plugin through 2.0.19 is vulnerable to deserialization of untrusted data, allowing object injection.
- CVE-2026-94662High
Stored XSS vulnerability in Unlimited Elements For Elementor plugin. Improper input neutralization during web page generation allows persistent injection of malicious script that executes on every page view. Affects versions from n/a through 2.0.19.
- CVE-2026-105064Medium
A Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection') vulnerability in Unlimited Elements For Elementor (Free Widgets, Addons, Templates) unlimited-elements-for-elementor allows Parameter Injection. This issue affects the plugin from n/a through 2.0.22.
- CVE-2026-103344High
The Unlimited Elements For Elementor plugin up to version 2.0.20 contains a reflected XSS vulnerability. An attacker can inject a malicious script that executes in the victim's browser.
- CVE-2026-103342High
Reflected XSS vulnerability in Unlimited Elements For Elementor up to version 2.0.20. Improper input neutralization during web page generation.
- CVE-2026-85568Medium
The Unlimited Elements for Elementor WordPress plugin before 2.0.21 does not correctly handle a search value before rewriting an already prepared SQL statement, allowing unauthenticated users to perform SQL injection attacks and to retrieve non-public content, when a related widget option is set away from its default.
Original NVD description (English source)
The Unlimited Elements For Elementor WordPress plugin before 2.0.11 does not sanitize or escape Google review content fetched from the Serp API before rendering it in the Google Reviews widget output, allowing unauthenticated attackers who submit a malicious review on the targeted business's Google listing to deliver Stored XSS to any visitor (including administrators) of any WP page displaying that Place ID's reviews.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS