CVE-2026-94168: WordPress Premium Addons for Elementor plugin <= 4.11.105 - Cross Site Scripting (XSS) vulnerability
Published Sep 23, 2026
·Updated
Contributor Cross Site Scripting (XSS) in Premium Addons for Elementor <= 4.11.105 versions.
Affected Software
1 affected component
Leap13 Premium Addons for Elementor<=4.11.105
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
WordPress Premium Addons for Elementorto a version that resolves this vulnerability.Fixed in 4.11.106
Event History
Sep 23, 2026
CVE Published
via MITRE·06:14 PM
Data Sourced
via MITRE·06:14 PM
RemedyDescriptionSeverityWeakness
Data Sourced
via NVD·07:19 PM
DescriptionSeverityWeakness
Frequently Asked Questions
1
Who can exploit this vulnerability?
An attacker needs Contributor-level access to a WordPress site using an affected Premium Addons for Elementor version. Exploitation also requires user interaction.
2
What impact could successful exploitation have?
The vulnerability is rated medium severity with network access, low attack complexity, required low privileges, and user interaction. Its CVSS vector indicates low confidentiality, integrity, and availability impact, with scope changed.