What is the CVSS score of CVE-2026-10081?

CVE-2026-10081 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.2%.

Which versions of Unlimited Elements For Elementor are affected by CVE-2026-10081?

Unlimited Elements For Elementor plugin (pre-2.0.11) has a stored XSS vulnerability with publicly available exploit code that permits unauthenticated attackers to inject JavaScript through Google…. A patch is available.

Is there a public PoC exploit available for CVE-2026-10081?

Yes, a public proof-of-concept exploit is available for CVE-2026-10081. Prioritise patching immediately. EPSS: 0.2%.

How to fix or mitigate CVE-2026-10081?

Within 24 hours, audit all WordPress installations for Unlimited Elements For Elementor plugin versions prior to 2.0.11 and document affected sites. Within 7 days, update all affected installations to version 2.0.11 and verify the update completed successfully. Within 30 days, conduct security scanning on affected sites to detect potential malicious content in Google reviews or stored XSS payloads, and review administrator account activity logs for unauthorized access during the vulnerable period.

Unlimited Elements For Elementor CVE-2026-10081

EUVD-2026-45876 HIGH

Cross-site Scripting (XSS) (CWE-79)

2026-07-20 WPScan

GHSA-jv99-4c76-v7q4

XSS Google WordPress Unlimited Elements For Elementor

8.8

CVSS 3.1 · Vendor: WPScan

Severity by source

Vendor (WPScan) PRIMARY

8.8 HIGH

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Primary rating from Vendor (WPScan) · only source for this CVE.

CVSS VectorVendor: WPScan

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 20, 2026 - 14:23 vuln.today

CVSS changed

Jul 20, 2026 - 14:22 NVD

8.8 (HIGH)

Patch available

Jul 20, 2026 - 09:17 EUVD

CVE Published

Jul 20, 2026 - 06:00 cve.org

HIGH 8.8

CVE Published

Jul 20, 2026 - 06:00 cve.org

UNKNOWN (no severity yet)

DescriptionCVE.org

The Unlimited Elements For Elementor WordPress plugin before 2.0.11 does not sanitize or escape Google review content fetched from the Serp API before rendering it in the Google Reviews widget output, allowing unauthenticated attackers who submit a malicious review on the targeted business's Google listing to deliver Stored XSS to any visitor (including administrators) of any WP page displaying that Place ID's reviews.

Articles & Coverage 1

News 6 New WordPress Vulnerabilities - 1 Critical, 5 High, All With POC Jul 21, 2026

AnalysisAI

Stored cross-site scripting in the Unlimited Elements For Elementor WordPress plugin (all versions before 2.0.11) lets an unauthenticated attacker plant a malicious Google review on a targeted business's Google listing that, once fetched via the Serp API and rendered unescaped in the Google Reviews widget, executes JavaScript in the browser of every visitor — including logged-in administrators — of any page showing that Place ID's reviews. Publicly available exploit code exists and the vendor has shipped a fix, but there is no public exploit identified as being used in active attacks. …

Unlock full vulnerability intelligence

Risk assessment & exploitation conditions
Attack chain visualization
Remediation with exact patch versions
Threat intelligence from 22 sources
Personal watchlist & email alerts

Continue with Google Continue with GitHub

Free forever · No credit card required

Recommended ActionAI

Within 24 hours, audit all WordPress installations for Unlimited Elements For Elementor plugin versions prior to 2.0.11 and document affected sites. …

Threat intelligence, references, and detailed analysis are available after sign-in.