CVE-2026-108490: WordPress Premium Addons for Elementor plugin <= 4.11.110 - Cross Site Scripting (XSS) vulnerability
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in LeapWorx Premium Addons for Elementor premium-addons-for-elementor allows Stored XSS.This issue affects Premium Addons for Elementor: from n/a through 4.11.110.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
wordpress/premium-addons-for-elementorto a version that resolves this vulnerability.Fixed in 4.11.111
Event History
Frequently Asked Questions
What level of access does an attacker need to exploit this issue?
The CVSS vector indicates that an attacker needs low-level privileges. The attack can be carried out remotely over the network.
Does exploitation require interaction from another user?
Yes. The CVSS vector indicates that user interaction is required, consistent with a stored XSS scenario in which another user must view or otherwise process the injected content.
What impact could successful exploitation have?
The reported CVSS vector rates confidentiality, integrity, and availability impact as low, and indicates a scope change. An exploited stored XSS issue may affect a security authority beyond the vulnerable plugin's direct scope.