Premium Addons for Elementor: Stored cross-site scripting (XSS)
Summary
Premium Addons for Elementor, a WordPress plugin with extra widgets for the Elementor page builder, up to and including version 4.11.116 contains a stored cross-site scripting flaw (CWE-79). An attacker with a low-privilege account, such as a Contributor, can save malicious script that runs in the browsers of other users, for example when a privileged user clicks a crafted link or opens a crafted page. Successful exploitation can allow session theft, account hijacking or manipulation of site content.
Affected
- Premium Addons for Elementor (WordPress plugin) up to and including 4.11.116
- Required privilege: low (Contributor), user interaction needed
Fixed in
- Version 4.11.117 (according to the CVE record and Patchstack; the vendor advisory could not be checked)
Workaround
- Unknown. No vendor or Patchstack workaround was found.
- Interim measure: review which accounts can create or edit Elementor content and restrict low-privilege accounts until the update is applied.
Exploitation
- Not known to be exploited (OffSeq); not listed as KEV (Strix).
- No public proof of concept found; this reflects a short search only.
Our recommendation
- Update Premium Addons for Elementor to version 4.11.117 or later in the next maintenance window.
- Check that the site runs the current plugin version.
- Review recent Elementor content edits by Contributor-level and other low-privilege users.
- Keep the plugin current, as this plugin has had several similar stored XSS CVEs in 2026.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Patchstack advisory CVE-2026-125762 patchstack.com
- CVE Record CVE-2026-125762 www.cve.org
- OffSeq radar entry CVE-2026-125762 radar.offseq.com
- Strix CVE entry CVE-2026-125762 www.strix.ai
- HOL Guard CVE-2026-103084 (similar earlier XSS) hol.org
- HOL Guard CVE-2026-108490 (similar earlier XSS) hol.org
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 11 Nov 2026, 14:25.
Original description (NVD)
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in LeapWorx Premium Addons for Elementor premium-addons-for-elementor allows Stored XSS.This issue affects Premium Addons for Elementor: from n/a through 4.11.116.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.