Unauthenticated Stored XSS in WordPress Plugin Unlimited Elements via Google Reviews (CVE-2026-10081)

WordPress Plugin Vulnerabilities Unlimited Elements for Elementor < 2.0.11 - Unauthenticated Stored XSS via Google Reviews Widget Description The plugin fails to sanitize or escape Google review content retrieved from the Serp API prior to rendering it within the Google Reviews widget output. This vulnerability allows unauthenticated attackers who submit a malicious review on the targeted business's Google listing to deliver Stored XSS payloads to any visitor (including administrators) of any WordPress page displaying reviews associated with that Place ID. Proof of Concept The PoC will be disclosed on July 27, 2026, to provide users with sufficient time to apply updates. Affected Plugins unlimited-elements-for-elementor (Fixed in version 2.0.11) References CVE: CVE-2026-10081 Classification Type: XSS OWASP Top 10: A7: Cross-Site Scripting (XSS) CWE: CWE-79 CVSS: 8.8 (High) Miscellaneous Original Researcher: Matthew Rollings Submitter: Matthew Rollings Submitter Website: https://sec.stealthcopter.com Submitter Twitter: stealthcopter Verified: Yes WPVDB ID: e5cde405-5b34-4d3d-bfda-325402b0a5bc Timeline Publicly Published: 2026-06-29 (approximately 21 days ago) Added: 2026-06-29 (approximately 20 days ago) Last Updated: 2026-07-17 (approximately 2 days ago) Related Vulnerabilities Published: 2025-01-07 - Title: Free WooCommerce Theme 99fy Extension < 1.2.9 - Authenticated (Contributor+) Stored Cross-Site Scripting Published: 2026-05-26 - Title: Animate Your Content <= 1.0.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes Published: 2024-11-14 - Title: WP Activity Log < 5.2.2 - Unauthenticated Stored Cross-Site Scripting via User_id Parameter Published: 2023-10-17 - Title: Media Library Assistant < 3.12 - Author+ Stored XSS Published: 2025-01-25 - Title: Survey Maker < 5.13.4 - Authenticated (Admin+) Stored Cross-Site Scripting via Survey Question

Goal Reached Thanks to every supporter — we hit 100%!

Unauthenticated Stored XSS in WordPress Plugin Unlimited Elements via Google Reviews (CVE-2026-10081)

More from this source