PULSE
LIVE28signals / 24h
ES
FEED
ransomtitan reclama a PERTINENT HEALTHCARE BUSINESS SOLUTIONS PRIVATE LIMITED · IN · Healthcareransomworldleaks reclama a St. Francis Xavier Catholic School System · US · Educationransomworldleaks reclama a PinnPACK · US · Manufacturingransomspacebears reclama a DoAllTech · KR · Technologyransomspacebears reclama a Anpra SAS · CO · Business Servicesransomspacebears reclama a BiesSse Group · IT · Business Servicesransomqilin reclama a Postres Reina · ES · Agriculture and Food Productionransomsafepay reclama a wdk.de · DE · Not Foundransomsafepay reclama a jaecklin-industrial.de · DE · Manufacturingransomsafepay reclama a lbb-treuhand.de · DE · Business Servicesransomsafepay reclama a timetex.de · DE · Business Servicesransomsafepay reclama a stroebel-gruppe.de · DE · Manufacturingransomsafepay reclama a industriesjaro.com · CA · Manufacturingransomsafepay reclama a cenesco.de · DE · Not Foundransomtitan reclama a PERTINENT HEALTHCARE BUSINESS SOLUTIONS PRIVATE LIMITED · IN · Healthcareransomworldleaks reclama a St. Francis Xavier Catholic School System · US · Educationransomworldleaks reclama a PinnPACK · US · Manufacturingransomspacebears reclama a DoAllTech · KR · Technologyransomspacebears reclama a Anpra SAS · CO · Business Servicesransomspacebears reclama a BiesSse Group · IT · Business Servicesransomqilin reclama a Postres Reina · ES · Agriculture and Food Productionransomsafepay reclama a wdk.de · DE · Not Foundransomsafepay reclama a jaecklin-industrial.de · DE · Manufacturingransomsafepay reclama a lbb-treuhand.de · DE · Business Servicesransomsafepay reclama a timetex.de · DE · Business Servicesransomsafepay reclama a stroebel-gruppe.de · DE · Manufacturingransomsafepay reclama a industriesjaro.com · CA · Manufacturingransomsafepay reclama a cenesco.de · DE · Not Found
← All CVEs
CVE WatchJul 20, 2026

CVE-2026-10081

The Unlimited Elements For Elementor WordPress plugin before 2.0.11 does not sanitize or escape Google review content fetched from the Serp

CVSS

8.8

High

EPSS

0.2%

p7

KEV

—

Exploit Today

2

0-100

Published: Jul 20, 2026 · Last modified: Jul 20, 2026 · CWE-79

EPSS · 30d

Not enough EPSS history yet.

Technical description

The Unlimited Elements For Elementor WordPress plugin before 2.0.11 does not sanitize or escape Google review content fetched from the Serp API before rendering it in the Google Reviews widget output, allowing unauthenticated attackers who submit a malicious review on the targeted business's Google listing to deliver Stored XSS to any visitor (including administrators) of any WP page displaying that Place ID's reviews.

Official references
Related CVEs
CVECVSSEPSSKEVRExploitTitleMod.
CVE-2021-252996.1 MED
99.9%
——30Nagios XI version xi-5.7.5 is affected by cross-site scripting (XSS). The vulnerability exists in the file /usr/local/nagiosxi/html/admin/sshterm.php due to improper sanitization of user-controlled input. A maliciously crafted URL, when clicked by an admin user, can be used to steal his/her session cookies or it can be chained with the previous bugs to get one-click remote command execution (RCE) on the Nagios XI server.12dCVE-2021-364506.1 MED
99.2%
——30Verint Workforce Optimization (WFO) 15.2.8.10048 allows XSS via the control/my_notifications NEWUINAV parameter.12dCVE-2023-414256.1 MED
98.9%
——30Cross Site Scripting vulnerability in Wonder CMS v.3.2.0 thru v.3.4.2 allows a remote attacker to execute arbitrary code via a crafted script uploaded to the installModule component.12dCVE-2022-330986.1 MED
98.8%
——30Magnolia CMS v6.2.19 was discovered to contain a cross-site scripting (XSS) vulnerability via the Edit Contact function. This vulnerability allows attackers to execute arbitrary web scripts or HTML via a crafted SVG document, with JavaScript, for a profile picture.12dCVE-2025-441489.8 CRI
98.8%
——30Cross Site Scripting (XSS) vulnerability in MailEnable before v10 allows a remote attacker to execute arbitrary code via the failure.aspx component16dCVE-2022-365335.4 MED
98.5%
——30Super Flexible Software GmbH & Co. KG Syncovery 9 for Linux v9.47x and below was discovered to contain a cross-site scripting (XSS) vulnerability.12d