Executive Summary
A stored cross-site scripting (XSS) vulnerability has been disclosed in the Unlimited Elements For Elementor WordPress plugin, affecting all versions prior to 2.0.11. The flaw carries a CVSS score of 8.8 (High) and allows unauthenticated attackers to inject malicious JavaScript by submitting a crafted Google review on a target business's Google profile.
Because the plugin fetches and renders Google Reviews content without sanitization or output escaping, any page rendering the Google Reviews widget will execute the attacker-controlled script in every visitor's browser.
CVSS Score: 8.8 (High)
Vulnerability Overview
| Attribute | Value |
|---|---|
| CVE ID | CVE-2026-10081 |
| CVSS Score | 8.8 (High) |
| Type | Stored Cross-Site Scripting (XSS) |
| Attack Vector | Network — attacker submits a malicious Google review |
| Authentication | None required (unauthenticated attack on Google side) |
| Privileges Required | None |
| User Interaction | Required (victim views the widget page) |
| Scope | Changed — attacker script executes in victim's browser context |
Affected Versions
| Plugin | Affected Versions | Fixed Version |
|---|---|---|
| Unlimited Elements For Elementor (Free Widgets, Addons, Templates) | < 2.0.11 | 2.0.11 |
The plugin has over 1 million active installations on WordPress.org, making the exposure surface extremely broad.
How the Vulnerability Works
The plugin's Google Reviews widget fetches review content from the Serp API and renders it directly into the widget output HTML without sanitizing the review text or escaping HTML entities.
An attacker can:
1. Identify a business that uses the Unlimited Elements Google Reviews widget
2. Post a malicious Google review on that business's Google profile
containing JavaScript payloads (e.g., <script>...</script> or
event-handler injections like onmouseover="...")
3. The plugin fetches reviews via the Serp API on page load
4. Unescaped review content is rendered directly into the page DOM
5. Visitor browsers execute the attacker's JavaScriptPotential Attacker Actions Post-Exploitation
| Impact | Description |
|---|---|
| Session Hijacking | Steal authentication cookies via document.cookie |
| Credential Harvesting | Overlay fake login forms to capture credentials |
| Malware Distribution | Redirect visitors to exploit kits or malicious downloads |
| Defacement | Alter page content visible to victims |
| Admin Privilege Escalation | If an admin views the page, attacker gains full WP access |
| Cryptocurrency Mining | Inject cryptominer scripts into visitor browsers |
Remediation
Step 1: Update the Plugin Immediately
# Via WP-CLI
wp plugin update unlimited-elements-for-elementor
# Verify the installed version
wp plugin get unlimited-elements-for-elementor --field=versionOr update through WordPress Admin → Plugins → Unlimited Elements → Update Now.
Step 2: Verify the Update
Confirm the installed version is 2.0.11 or later:
- Navigate to Plugins → Installed Plugins
- Locate Unlimited Elements For Elementor
- Confirm the version number shown is 2.0.11+
Step 3: If Immediate Patching Is Not Possible
- Disable the Google Reviews widget on all Elementor pages
- Remove the Serp API key from plugin settings to prevent review fetching
- Deploy a WAF rule to strip
<script>tags and event handlers from widget output - Monitor your web server logs for unusual POST requests or redirects
Detection
Look for signs of exploitation in site logs and visitor reports:
| Indicator | What to Look For |
|---|---|
| Unusual redirect patterns | Visitors being sent to unfamiliar domains |
| Admin account creation | New administrator accounts appearing unexpectedly |
| Plugin/theme modifications | File changes in wp-content after viewing the widget page |
| Browser console errors | JavaScript errors from unexpected domains |
| Security plugin alerts | Wordfence, Sucuri, or iThemes flagging injected scripts |
Post-Remediation Checklist
- Confirm plugin updated to 2.0.11 or later
- Scan for injected content — review all pages hosting the Google Reviews widget for residual malicious scripts
- Rotate all credentials — WordPress admin passwords, API keys, and database passwords
- Review administrator accounts — remove any unauthorized admin users
- Check for backdoors — scan wp-content for newly created PHP files
- Implement a Web Application Firewall — Wordfence (free tier available) or Cloudflare WAF
- Enable auto-updates for plugins to prevent similar issues in the future
- Audit review content — request Google remove any malicious reviews from your business profile
References
- NIST NVD — CVE-2026-10081
- Wordfence — Unlimited Elements For Elementor Vulnerability
- WordPress Plugin Repository — Unlimited Elements For Elementor