CVE-2026-108482: WordPress Premium Addons for Elementor plugin <= 4.11.110 - Cross Site Scripting (XSS) vulnerability
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in LeapWorx Premium Addons for Elementor premium-addons-for-elementor allows Stored XSS.This issue affects Premium Addons for Elementor: from n/a through 4.11.110.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
wordpress/premium-addons-for-elementorto a version that resolves this vulnerability.Fixed in 4.11.111
Event History
Frequently Asked Questions
What level of access does an attacker need to exploit this issue?
The vulnerability requires low-level authenticated privileges (PR:L) and user interaction (UI:R). It is remotely reachable over the network (AV:N) with low attack complexity (AC:L).
Which installations are affected?
Premium Addons for Elementor versions through 4.11.110 are affected. The provided data does not specify whether any particular default configuration or feature must be enabled.
What is the potential impact of successful exploitation?
Successful exploitation can result in stored cross-site scripting. The supplied severity vector indicates low confidentiality, integrity, and availability impact, with scope changed (S:C).
How can I determine whether my site is exposed?
Check whether the installed Premium Addons for Elementor version is 4.11.110 or earlier. Also determine which low-privileged users can submit content that may later be rendered to other users, since exploitation requires authenticated low-level access and user interaction.