CVE-2026-10081 Overview
CVE-2026-10081 is a Stored Cross-Site Scripting (XSS) vulnerability in the Unlimited Elements For Elementor WordPress plugin before version 2.0.11. The plugin fails to sanitize or escape Google review content fetched from the Serp API before rendering it in the Google Reviews widget. Unauthenticated attackers can submit a malicious review on a targeted business's Google listing, which the plugin then renders on any WordPress page displaying that Place ID's reviews. The payload executes in the browser of every visitor, including administrators. This vulnerability is classified under [CWE-79] (Improper Neutralization of Input During Web Page Generation).
Critical Impact
An unauthenticated attacker can achieve Stored XSS against site administrators by posting a crafted Google review, enabling session hijacking, account takeover, and site-wide compromise.
Affected Products
- Unlimited Elements For Elementor (WordPress plugin) versions before 2.0.11
- WordPress sites using the Google Reviews widget provided by the plugin
- Any page rendering reviews for an attacker-targeted Google Place ID
Discovery Timeline
- 2026-07-20 - CVE-2026-10081 published to NVD
- 2026-07-21 - Last updated in NVD database
Technical Details for CVE-2026-10081
Vulnerability Analysis
The Unlimited Elements For Elementor plugin integrates third-party Google review data into WordPress pages via the Serp API. When the Google Reviews widget renders content, the plugin outputs the review author name, text, and related fields directly into the page markup. The plugin does not apply WordPress escaping functions such as esc_html(), esc_attr(), or wp_kses() to this externally sourced data.
Because Google reviews accept free-form user input and are indexed by Place ID, an attacker only needs to write a review containing HTML or JavaScript on the victim business's Google listing. Once the plugin fetches and displays that review, the payload executes in the context of the WordPress site. The attack requires no authentication on the WordPress side and no direct interaction with the target site.
Root Cause
The root cause is missing output encoding of third-party content [CWE-79]. The plugin treats Serp API responses as trusted, despite the source data originating from arbitrary Google users. Any HTML metacharacters or <script> tags in the review payload are passed through unchanged.
Attack Vector
The attack chain is entirely remote and unauthenticated on the WordPress side. An attacker identifies a target site using the Google Reviews widget, determines its configured Place ID, and posts a review containing an XSS payload to that Google business listing. When any visitor loads a WordPress page rendering those reviews, the browser parses and executes the injected script. Because administrators viewing dashboards or public pages are equally affected, the attacker can escalate to full site takeover via cookie theft, CSRF against admin endpoints, or plugin installation.
No verified public exploit code is available. See the WPScan Vulnerability Advisory for further technical detail.
Detection Methods for CVE-2026-10081
Indicators of Compromise
- Unexpected <script>, <iframe>, or event handler attributes rendered inside Google Reviews widget markup on published pages.
- Outbound requests from visitor browsers to attacker-controlled domains referenced from pages containing the reviews widget.
- Administrator sessions initiating unusual actions such as plugin installation or user creation shortly after visiting a reviews page.
Detection Strategies
- Scan installed WordPress plugins for unlimited-elements-for-elementor at versions below 2.0.11.
- Inspect rendered HTML of pages using the Google Reviews widget for unescaped HTML entities in review text or author fields.
- Review web server access logs for anomalous requests to /wp-admin/ endpoints originating from sessions that recently loaded a reviews page.
Monitoring Recommendations
- Enable a Content Security Policy (CSP) with script-src restrictions and monitor CSP violation reports for blocked inline scripts on reviews pages.
- Alert on new administrator accounts, plugin uploads, or theme edits following visits to public pages that render third-party review data.
- Track outbound connections from WordPress servers to the Serp API and correlate response payloads with rendered page content.
How to Mitigate CVE-2026-10081
Immediate Actions Required
- Update the Unlimited Elements For Elementor plugin to version 2.0.11 or later on every WordPress instance.
- Temporarily disable the Google Reviews widget on pages configured with Place IDs pointing to businesses that accept public reviews.
- Rotate administrator session cookies and passwords if the plugin has been in use with unsanitized review data.
Patch Information
The vendor addressed the vulnerability in Unlimited Elements For Elementor version 2.0.11 by adding output escaping for Serp API review fields. Refer to the WPScan Vulnerability Advisory for the fixed version and remediation guidance.
Workarounds
- Remove or deactivate the Google Reviews widget until the plugin is upgraded to 2.0.11.
- Deploy a Web Application Firewall (WAF) rule to strip <script> tags and event handler attributes from responses on pages containing the widget output.
- Enforce a strict Content Security Policy that disallows inline JavaScript on WordPress front-end pages.
# Configuration example: update the plugin via WP-CLI
wp plugin update unlimited-elements-for-elementor --version=2.0.11
wp plugin list --name=unlimited-elements-for-elementor --fields=name,version,status
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
