CVE-2026-125762: WordPress Premium Addons for Elementor plugin <= 4.11.116 - Cross Site Scripting (XSS) vulnerability

Q: Who can exploit this issue?

Exploitation requires an attacker with low-level privileges. It is not identified as exploitable by an unauthenticated attacker.

Q: Does exploitation require a victim to do anything?

Yes. The attack vector indicates user interaction is required, meaning a user must interact with attacker-controlled content for the XSS to take effect.

Q: Which installations should be treated as affected?

Premium Addons for Elementor versions through 4.11.116 are affected. The provided data does not identify a fixed version or an interim workaround.

Q: What is the potential impact after successful exploitation?

The vulnerability can result in limited confidentiality, integrity, and availability impact, and its scope can extend beyond the vulnerable component.

Published Nov 11, 2026

Updated

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in LeapWorx Premium Addons for Elementor premium-addons-for-elementor allows Stored XSS.This issue affects Premium Addons for Elementor: from n/a through 4.11.116.

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade premium-addons-for-elementor to a version that resolves this vulnerability.
Fixed in 4.11.117

Event History

Nov 11, 2026

CVE Published

via MITRE·12:34 PM

Data Sourced

via MITRE·12:34 PM

RemedyDescriptionSeverityWeakness

Data Sourced

via NVD·01:17 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Who can exploit this issue?

Exploitation requires an attacker with low-level privileges. It is not identified as exploitable by an unauthenticated attacker.

Does exploitation require a victim to do anything?

Yes. The attack vector indicates user interaction is required, meaning a user must interact with attacker-controlled content for the XSS to take effect.

Which installations should be treated as affected?

Premium Addons for Elementor versions through 4.11.116 are affected. The provided data does not identify a fixed version or an interim workaround.

What is the potential impact after successful exploitation?

The vulnerability can result in limited confidentiality, integrity, and availability impact, and its scope can extend beyond the vulnerable component.

CVE-2026-125762: WordPress Premium Addons for Elementor plugin <= 4.11.116 - Cross Site Scripting (XSS) vulnerability

Remediation

Event History

Frequently Asked Questions

Who can exploit this issue?

Does exploitation require a victim to do anything?

Which installations should be treated as affected?

What is the potential impact after successful exploitation?

Company

Resources

Contact

Frequently Asked Questions

Who can exploit this issue?

Does exploitation require a victim to do anything?

Which installations should be treated as affected?

What is the potential impact after successful exploitation?