Read the docs
TI-2026-08837 Aliases CVE-2026-10081GHSA-jv99-4c76-v7q4

Unlimited Elements for Elementor < 2.0.11 - Unauthenticated Stored XSS via Google Reviews Widget

Priority HIGH 73CWE-79Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
Required
Attack complexity
Low
Impact type
Cross-site scripting
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 3.1 · CISA ADP. Fix status from CNA. Impact type from CWE-79.

Summary

The Unlimited Elements For Elementor WordPress plugin before 2.0.11 does not sanitize or escape Google review content fetched from the Serp API before rendering it in the Google Reviews widget output, allowing unauthenticated attackers who submit a malicious review on the targeted business's Google listing to deliver Stored XSS to any visitor (including administrators) of any WP page displaying that Place ID's reviews.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00505 43rd percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by the CNA
Fix Fixed Unlimited Elements For Elementor (Unknown): 2.0.11

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
UnknownUnlimited Elements For Elementorbefore 2.0.112.0.11Patch availableCNA
  • Unlimited Elements For Elementor VendorUnknown Affected before 2.0.11 Fixed in 2.0.11 Patch available CNA

Remediation

  • Fix · CNA Unlimited Elements For Elementor (Unknown) Fixed in 2.0.11

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-10081
  2. 2026-10-03 Alias added: GHSA-jv99-4c76-v7q4

References

Exploit 1

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences