EUVD-2026-45876
GHSA-jv99-4c76-v7q4
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization Output encoding, context-aware escaping
MITRE ATT&CK
2 techniques across 2 tactics: Initial Access, Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jul 20, 2026
Stored cross-site scripting in the Unlimited Elements For Elementor WordPress plugin (all versions before 2.0.11) lets an unauthenticated attacker plant a malicious Google review on a targeted business's Google listing that, once fetched via the Serp API and rendered unescaped in the Google Reviews widget, executes JavaScript in the browser of every visitor — including logged-in administrators — of any page showing that Place ID's reviews. Publicly available exploit code exists and the vendor has shipped a fix, but there is no public exploit identified as being used in active attacks. The injection is delivered through third-party review content rather than a direct request to the WordPress site, making it a supply-chain-style stored XSS.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Know when Unlimited Elements For Elementor gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Primary rating from Vendor (WPScan) · only source for this CVE.
CVSS VectorVendor: WPScan
Lifecycle Timeline
4DescriptionCVE.org
The Unlimited Elements For Elementor WordPress plugin before 2.0.11 does not sanitize or escape Google review content fetched from the Serp API before rendering it in the Google Reviews widget output, allowing unauthenticated attackers who submit a malicious review on the targeted business's Google listing to deliver Stored XSS to any visitor (including administrators) of any WP page displaying that Place ID's reviews.
Articles & Coverage 1
Executive ViewAI
Unlimited Elements For Elementor plugin (pre-2.0.11) has a stored XSS vulnerability with publicly available exploit code that permits unauthenticated attackers to inject JavaScript through Google reviews, executing in all visitor browsers including administrator sessions. Affected organizations face risk of customer data compromise, admin account hijacking, and brand reputation damage. Vendor-released patch 2.0.11 is available.
Within 24 hours, audit all WordPress installations for Unlimited Elements For Elementor plugin versions prior to 2.0.11 and document affected sites. Within 7 days, update all affected installations to version 2.0.11 and verify the update completed successfully. Within 30 days, conduct security scanning on affected sites to detect potential malicious content in Google reviews or stored XSS payloads, and review administrator account activity logs for unauthorized access during the vulnerable period.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Cross-Site Scripting occurs when an application accepts untrusted data and sends it to a web browser without proper validation or encoding.
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Unlimited Elements
PHP object injection in the Unlimited Elements For Elementor WordPress plugin (versions before 2.0.20) lets authenticate
Unauthenticated SQL injection in the WordPress plugin Unlimited Elements for Elementor (versions 1.5.139 through before
Authenticated path traversal in the Unlimited Elements for Elementor WordPress plugin before 2.0.21 lets a privileged us
Blind SQL injection in the Unlimited Elements for Elementor WordPress plugin (all releases before 2.0.21) allows an auth
The Unlimited Elements For Elementor (Free Widgets, Addons, Templates) plugin for WordPress is vulnerable to Remote Code
Unrestricted Upload of File with Dangerous Type vulnerability in Unlimited Elements Unlimited Elements For Elementor (Fr
Unrestricted Upload of File with Dangerous Type vulnerability in Unlimited Elements Unlimited Elements For Elementor (Fr
Deserialization of Untrusted Data vulnerability in Unlimited Elements Unlimited Elements For Elementor (Free Widgets, Ad
Authenticated WordPress users holding a role as low as Subscriber can cause arbitrary shortcodes to be executed on sites
The Unlimited Elements For Elementor (Free Widgets, Addons, Templates) plugin for WordPress is vulnerable to blind SQL I
The Unlimited Elements For Elementor (Free Widgets, Addons, Templates) plugin for WordPress is vulnerable to SQL Injecti
Exploit-DB