CVE-2026-4790: Premium Addons for Elementor <= 4.11.70 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'custom_svg' Parameter
The Premium Addons for Elementor – Powerful Elementor Templates & Widgets plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'customsvg' parameter in versions up to, and including, 4.11.70 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-4790?
CVE-2026-4790 has a high severity due to its potential for Stored Cross-Site Scripting vulnerabilities.
How do I fix CVE-2026-4790?
To fix CVE-2026-4790, update the Premium Addons for Elementor plugin to a version higher than 4.11.70.
Who is affected by CVE-2026-4790?
CVE-2026-4790 affects users of the Premium Addons for Elementor plugin for WordPress versions 4.11.70 and below.
What is the impact of CVE-2026-4790?
The impact of CVE-2026-4790 includes the possibility of attackers executing malicious scripts in the browser of users who view affected pages.
Is authentication required for CVE-2026-4790 exploitation?
Yes, exploitation of CVE-2026-4790 requires a user to be authenticated as a Contributor or higher.