CVE-2026-108482

6.5Medium

Published 12 Oct 2026 · NVD status: Deferred · AI triage by gemini-3.8-flash

6.5Medium

Attack vector: Network
Complexity: Low
Privileges needed: Low
User interaction: Required
Impact: Limited impact
Weakness: CWE-79

Impact

Authenticated attackers with low privileges can inject persistent malicious scripts to hijack user sessions or deface pages when viewed by other users. They need network access to the WordPress site, valid credentials, and a victim to view the injected content.

Root cause

The plugin fails to properly sanitize and neutralize user-supplied input before storing and rendering it on pages, resulting in stored cross-site scripting.

Affected systems

LeapWorx Premium Addons for Elementor through 4.11.110

CVSS v3.1 · CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L

Fix & remediation

Upgrade Premium Addons for Elementor to a version newer than 4.11.110 once available; if patching must wait, deactivate the plugin via wp-cli or the admin panel.

shell

$ wp plugin update premium-addons-for-elementor

AI-suggested. Run it in staging first and check it against the vendor advisory. Why?

Ad · In-content banner

NVD description

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in LeapWorx Premium Addons for Elementor premium-addons-for-elementor allows Stored XSS.This issue affects Premium Addons for Elementor: from n/a through 4.11.110.

References

https://patchstack.com/database/wordpress/plugin/premium-addons-for-elementor/vulnerability/wordpress-premium-addons-for-elementor-plugin-4-11-110-cross-site-scripting-xss-vulnerability?_s_id=cve

Source: nvd.nist.gov/vuln/detail/CVE-2026-108482