CVE-2026-108490

6.5Medium

Published 13 Oct 2026 · NVD status: Deferred · AI triage by gemini-3.8-flash

6.5Medium

Attack vector: Network
Complexity: Low
Privileges needed: Low
User interaction: Required
Impact: Limited impact
Weakness: CWE-79

Impact

Authenticated attackers with low-level privileges can inject malicious scripts that execute in the browsers of users viewing affected pages. This can lead to session hijacking or unauthorized administrative actions when an admin visits the compromised page.

Root cause

The plugin fails to sanitize and neutralize user-supplied input before rendering it in web pages, leading to stored cross-site scripting.

Affected systems

LeapWorx Premium Addons for Elementor through 4.11.110

CVSS v3.1 · CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L

Fix & remediation

Upgrade Premium Addons for Elementor to a version higher than 4.11.110 once available, or deactivate the plugin immediately if an update cannot be applied.

shell

$ wp plugin update premium-addons-for-elementor

AI-suggested. Run it in staging first and check it against the vendor advisory. Why?

Ad · In-content banner

NVD description

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in LeapWorx Premium Addons for Elementor premium-addons-for-elementor allows Stored XSS.This issue affects Premium Addons for Elementor: from n/a through 4.11.110.

References

https://patchstack.com/database/wordpress/plugin/premium-addons-for-elementor/vulnerability/wordpress-premium-addons-for-elementor-plugin-4-11-110-cross-site-scripting-xss-vulnerability-2?_s_id=cve

Source: nvd.nist.gov/vuln/detail/CVE-2026-108490