{"id":"CVE-2026-125762","kind":"vulnerability","aliases":["CVE-2026-125762"],"related":[],"title":"Premium Addons for Elementor: stored XSS lets attackers run scripts in pages","description":"Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in LeapWorx Premium Addons for Elementor premium-addons-for-elementor allows Stored XSS.This issue affects Premium Addons for Elementor: from n/a through 4.11.116.","summary":"Premium Addons for Elementor, a WordPress plugin from LeapWorx, does not neutralize input when generating web pages, enabling stored cross-site scripting. An attacker can plant script that runs in the browser of anyone who views the affected page.","severity":"medium","cvss":6.5,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"premium-addons-for-elementor","fixed":[],"affected":"","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["elementor","package","premium-addons-for-elementor","wordpress"],"not_affected_if":["plugin-not-installed"],"how_to_check":"- Check the installed plugin version in WordPress under Plugins, or in the plugin's main file header, for `premium-addons-for-elementor`","fix":"- Premium Addons for Elementor: unknown (sources state the affected range through 4.11.116 but no fixed version)","status":"open","published_at":"2026-11-11T13:17:22+00:00","first_seen_at":"2026-11-11T13:27:14+00:00","triaged_at":"2026-11-11T13:29:13+00:00","updated_at":"2026-11-11T13:29:13+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-11-11T13:29:13Z","model":"claude-haiku-5-5","output":{"fix":"- Premium Addons for Elementor: unknown (sources state the affected range through 4.11.116 but no fixed version)","reach":"internet","title":"Premium Addons for Elementor: stored XSS lets attackers run scripts in pages","impact":"medium","summary":"Premium Addons for Elementor, a WordPress plugin from LeapWorx, does not neutralize input when generating web pages, enabling stored cross-site scripting. An attacker can plant script that runs in the browser of anyone who views the affected page.","audience":"businesses","category":"package","nicknames":[],"who_cares":["wordpress","elementor","premium-addons-for-elementor"],"confidence":0.6,"fix_status":"unknown","needs_auth":"unknown","worst_case":"script runs in visitors' browsers, session data stolen","analyst_note":"Confirm the fixed version and whether authentication is needed to store the payload, from the NVD entry or the vendor changelog.","how_to_check":"- Check the installed plugin version in WordPress under Plugins, or in the plugin's main file header, for `premium-addons-for-elementor`\n- Unknown whether a setting limits exposure","plain_action":"","product_name":"premium-addons-for-elementor","needs_analyst":true,"not_affected_if":["plugin-not-installed"],"who_is_affected":"Sites running Premium Addons for Elementor through version 4.11.116 are affected. The sources do not say which roles or settings are required to inject the script, so unknown whether logged-in access is needed.","user_interaction":"unknown","product_ecosystem":"vendor","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000746,"input_tokens":4563,"output_tokens":579,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-125762':15A,18A '-2026':14A,17A '4.11.116':108C 'addon':2A,28B,33B,88C,93C,102C 'addons':21A 'affect':70B,100C 'allow':96C 'anyon':66B 'attack':8A,56B 'browser':64B 'cross':52B,81C 'cross-sit':51B,80C 'cve':13A,16A 'elementor':4A,23A,24B,30B,35B,90C,95C,104C 'enabl':49B 'for':22A 'generat':46B,79C 'improp':72C 'input':44B,75C 'issu':99C 'leapworx':40B,86C 'let':7A 'n/a':106C 'neutral':43B,73C 'packag':25B 'page':12A,48B,71B,78C 'plant':58B 'plugin':38B 'premium':1A,20A,27B,32B,87C,92C,101C 'premium-addons-for-elementor':19A,26B,91C 'run':9A,61B 'script':10A,54B,59B,83C 'site':53B,82C 'store':5A,50B,97C 'view':68B 'vulner':84C 'web':47B,77C 'wordpress':31B,37B 'xss':6A 'xss.this':98C","nicknames":[],"mitigations":[],"who_affected":"Sites running Premium Addons for Elementor through version 4.11.116 are affected. The sources do not say which roles or settings are required to inject the script, so unknown whether logged-in access is needed.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"unknown","audience":"businesses","plain_action":null,"pkeys":["premiumaddonsforelementor"],"ptokens":["addons","elementor","for","premium"],"labels":["elementor","medium","package","premiumaddonsforelementor","vendor","wordpress"],"campaign_type":null,"search_a":"'-125762':15A,18A '-2026':14A,17A 'addon':2A 'addons':21A 'attack':8A 'cve':13A,16A 'elementor':4A,23A 'for':22A 'let':7A 'page':12A 'premium':1A,20A 'premium-addons-for-elementor':19A 'run':9A 'script':10A 'store':5A 'xss':6A","search_b":"'addon':28B,33B 'affect':70B 'anyon':66B 'attack':56B 'browser':64B 'cross':52B 'cross-sit':51B 'elementor':24B,30B,35B 'enabl':49B 'generat':46B 'input':44B 'leapworx':40B 'neutral':43B 'packag':25B 'page':48B,71B 'plant':58B 'plugin':38B 'premium':27B,32B 'premium-addons-for-elementor':26B 'run':61B 'script':54B,59B 'site':53B 'store':50B 'view':68B 'web':47B 'wordpress':31B,37B","search_c":"'4.11.116':108C 'addon':88C,93C,102C 'affect':100C 'allow':96C 'cross':81C 'cross-sit':80C 'elementor':90C,95C,104C 'generat':79C 'improp':72C 'input':75C 'issu':99C 'leapworx':86C 'n/a':106C 'neutral':73C 'page':78C 'premium':87C,92C,101C 'premium-addons-for-elementor':91C 'script':83C 'site':82C 'store':97C 'vulner':84C 'web':77C 'xss.this':98C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-11T13:17:22+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L","cvss_by":"audit@patchstack.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-125762","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-125762","severity":null,"published_at":"2026-11-11T13:17:22+00:00","modified_at":"2026-11-11T13:17:22+00:00","first_seen_at":"2026-11-11T13:27:14+00:00","fetched_at":"2026-11-11T13:27:14+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}