What is the CVSS score of EUVD-2026-45876?

EUVD-2026-45876 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.2%.

Which versions of Unlimited Elements For Elementor are affected by EUVD-2026-45876?

Unlimited Elements For Elementor plugin (pre-2.0.11) has a stored XSS vulnerability with publicly available exploit code that permits unauthenticated attackers to inject JavaScript through Google…. A patch is available.

Is there a public PoC exploit available for EUVD-2026-45876?

Yes, a public proof-of-concept exploit is available for EUVD-2026-45876. Prioritise patching immediately. EPSS: 0.2%.

How to fix or mitigate EUVD-2026-45876?

Within 24 hours, audit all WordPress installations for Unlimited Elements For Elementor plugin versions prior to 2.0.11 and document affected sites. Within 7 days, update all affected installations to version 2.0.11 and verify the update completed successfully. Within 30 days, conduct security scanning on affected sites to detect potential malicious content in Google reviews or stored XSS payloads, and review administrator account activity logs for unauthorized access during the vulnerable period.

Unlimited Elements For Elementor EUVD-2026-45876

| CVE-2026-10081 HIGH

Cross-site Scripting (XSS) (CWE-79)

2026-07-20 WPScan

GHSA-jv99-4c76-v7q4

WordPress XSS Google Unlimited Elements For Elementor Unknown

8.8

CVSS 3.1 · Vendor: WPScan

Severity by source

Vendor (WPScan) PRIMARY

8.8 HIGH

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Primary rating from Vendor (WPScan) · only source for this CVE.

CVSS VectorVendor: WPScan

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 20, 2026 - 14:23 vuln.today

CVSS changed

Jul 20, 2026 - 14:22 NVD

8.8 (HIGH)

Patch available

Jul 20, 2026 - 09:17 EUVD

CVE Published

Jul 20, 2026 - 06:00 cve.org

HIGH 8.8

CVE Published

Jul 20, 2026 - 06:00 cve.org

UNKNOWN (no severity yet)

DescriptionCVE.org

The Unlimited Elements For Elementor WordPress plugin before 2.0.11 does not sanitize or escape Google review content fetched from the Serp API before rendering it in the Google Reviews widget output, allowing unauthenticated attackers who submit a malicious review on the targeted business's Google listing to deliver Stored XSS to any visitor (including administrators) of any WP page displaying that Place ID's reviews.

Articles & Coverage 1

News 6 New WordPress Vulnerabilities - 1 Critical, 5 High, All With POC Jul 21, 2026

AnalysisAI

Stored cross-site scripting in the Unlimited Elements For Elementor WordPress plugin (all versions before 2.0.11) lets an unauthenticated attacker plant a malicious Google review on a targeted business's Google listing that, once fetched via the Serp API and rendered unescaped in the Google Reviews widget, executes JavaScript in the browser of every visitor — including logged-in administrators — of any page showing that Place ID's reviews. Publicly available exploit code exists and the vendor has shipped a fix, but there is no public exploit identified as being used in active attacks. The injection is delivered through third-party review content rather than a direct request to the WordPress site, making it a supply-chain-style stored XSS.