The Unlimited Elements For Elementor WordPress plugin versions prior to 2.0.11 do not properly sanitize or escape Google review content obtained via the Serp API. This vulnerability enables unauthenticated attackers to inject malicious scripts by submitting crafted reviews on the targeted business's Google listing. When these reviews are displayed in the Google Reviews widget on WordPress sites using the plugin, the malicious scripts execute in the context of the site, resulting in stored cross-site scripting (CWE-79). No CVSS score or official remediation level is provided in the available data.

Successful exploitation allows attackers to execute arbitrary JavaScript in the browsers of visitors to WordPress pages displaying the affected Google Reviews widget. This can lead to session hijacking, defacement, or other malicious actions performed with the privileges of the victim user, including administrators. The vulnerability arises from improper input handling of third-party content and affects site integrity and user security.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, administrators should consider disabling the Google Reviews widget or removing the plugin from affected sites to prevent exploitation. Monitor official Unlimited Elements For Elementor communications for updates and apply any released patches promptly.