What is the CVSS score of CVE-2026-103084?

CVE-2026-103084 has a CVSS 3.1 base score of 6.5 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L. EPSS exploitation probability: 0.2%.

Premium Addons CVE-2026-103084

EUVD-2026-92321 MEDIUM

Cross-site Scripting (XSS) (CWE-79)

2026-10-05 Patchstack

GHSA-x3v2-5w4j-jwwx

WordPress XSS Premium Addons For Elementor Wordpress Plugin

6.5

CVSS 3.1 · Vendor: Patchstack

Severity by source

Vendor (Patchstack) PRIMARY

6.5 MEDIUM

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L

vuln.today AI

6.5 MEDIUM

Authenticated low-priv user injects stored script (PR:L), victim must view it (UI:R), and execution in another user's context crosses a scope boundary (S:C) with limited C/I/A impact.

3.1 AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L

4.0 AV:N/AC:L/AT:N/PR:L/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N

Primary rating from Vendor (Patchstack).

CVSS VectorVendor: Patchstack

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

Required

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

Low

Lifecycle Timeline

Analysis Generated

Oct 05, 2026 - 09:38 vuln.today

CVE Published

Oct 05, 2026 - 08:49 cve.org

MEDIUM 6.5

DescriptionCVE.org

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in LeapWorx Premium Addons for Elementor premium-addons-for-elementor allows Stored XSS.This issue affects Premium Addons for Elementor: from n/a through 4.11.109.

AnalysisAI

Stored cross-site scripting (XSS) in the LeapWorx Premium Addons for Elementor WordPress plugin, affecting versions through 4.11.109, allows an authenticated low-privileged user (contributor/author level, PR:L) to persist malicious script into plugin-handled content that executes in the browser of a higher-privileged victim who later views it (UI:R). Successful exploitation can lead to session theft, credential harvesting, or administrative actions performed in the victim's context, though it requires valid account access and victim interaction rather than being a zero-click or unauthenticated attack. …

Unlock full vulnerability intelligence

Risk assessment & exploitation conditions
Attack chain visualization
Remediation with exact patch versions
Threat intelligence from 22 sources
Personal watchlist & email alerts

Continue with Google Continue with GitHub

No credit card · 7-day full trial

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access

technique details hidden

Delivery

technique details hidden

Exploit

technique details hidden

Execution

technique details hidden

Impact

technique details hidden

Access

technique details hidden

Delivery

technique details hidden

Exploit

technique details hidden

Execution

technique details hidden

Impact

technique details hidden

Vulnerability AssessmentAI

Exploitation	Requires an authenticated WordPress account with at least contributor/author-level access (PR:L) to inject the stored payload into a Premium Addons for Elementor input, plus subsequent interaction (UI:R) by a victim - typically an administrator viewing the stored content - for the script to execute. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment	This is a moderate-severity Stored XSS (CWE-79) carrying a CVSS 3.1 base score of 6.5 with vector AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario	Full exploit scenario with step-by-step reproduction available after sign-in.
Remediation	Vendor-released patch: none identified in the available data - no fixed version is specified, so the Patchstack advisory (https://patchstack.com/database/wordpress/plugin/premium-addons-for-elementor/vulnerability/wordpress-premium-addons-for-elementor-plugin-4-11-109-cross-site-scripting-xss-vulnerability?_s_id=cve) and the plugin's WordPress.org changelog should be checked for a release above 4.11.109 before assuming coverage, and the plugin should be updated to the newest available version as soon as one is published. … Detailed patch versions, workarounds, and compensating controls in full report.