CVE-2026-62078: WordPress Premium Addons for Elementor plugin <= 4.11.105 - Cross Site Scripting (XSS) vulnerability
Published Sep 30, 2026
·Updated
Contributor Cross Site Scripting (XSS) in Premium Addons for Elementor <= 4.11.105 versions.
Affected Software
1 affected component
Leap13 Premium Addons for Elementor<=4.11.105
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
WordPress Premium Addons for Elementorto a version that resolves this vulnerability.Fixed in 4.11.106
Event History
Sep 30, 2026
CVE Published
via MITRE·12:26 PM
Data Sourced
via MITRE·12:26 PM
RemedyDescriptionSeverityWeakness
Data Sourced
via NVD·01:17 PM
DescriptionSeverityWeakness
Frequently Asked Questions
1
What level of access does an attacker need to exploit this issue?
The attacker needs Contributor-level access to the affected WordPress site. Exploitation also requires user interaction.
2
Which plugin versions are affected?
Premium Addons for Elementor versions 4.11.105 and earlier are affected.
3
What impact could successful exploitation have?
The vulnerability is cross-site scripting with low confidentiality, integrity, and availability impact. The scope is changed, meaning impact can extend beyond the vulnerable component's authorization boundary.