Premium Addons CVE-2026-108482

Exploitation requires an authenticated WordPress account with at least low-level content-contribution privileges (PR:L, consistent with contributor/author-tier access that can submit content through the plugin's Elementor widgets), plus victim user interaction (UI:R) - a privileged user or site visitor must render the page containing the stored payload for the script to execute. Limiting factors: the attacker cannot be fully anonymous (some authenticated role is needed), the payload fires only when a victim views the affected content, and only sites running Premium Addons for Elementor at or below version 4.11.110 are affected. No non-default configuration is explicitly required by the available data, but the plugin must be installed and the vulnerable input field must be reachable by the attacker's role.

This is a moderate, authenticated stored XSS (CWE-79) in the Premium Addons for Elementor WordPress plugin, scored CVSS 6.5 (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L). The CVSS vector signals network reach with low complexity, but two factors meaningfully constrain real-world risk: PR:L means the attacker must already hold an authenticated, privilege-bearing account (typically contributor/author-level in WordPress plugin stored-XSS cases), and UI:R means a victim must view the injected page for the payload to fire. There is no EPSS score, no CISA KEV listing, and no public proof-of-concept in the provided data, so there is no public exploit identified at time of analysis and no evidence of active exploitation - the risk here is latent, not urgent. The scope change (S:C) and low C/I/A impacts are consistent with script execution in a victim's browser session rather than direct server compromise. Net assessment: a genuine but second-tier issue - not a high-real-risk, drop-everything flaw, but worth patching on a normal cadence given the plugin's broad deployment. Note that EPSS data is entirely absent (not zero), so exploitation probability could not be quantified; this is missing data, not a low-risk signal.

An attacker with a low-privileged authenticated WordPress account (e.g. contributor or author) injects a malicious script payload through a Premium Addons for Elementor input field that is not properly sanitized, storing it in the site. When an administrator or another user later views the page or content containing the widget, the script executes in their browser session, potentially enabling session/cookie theft or actions in the victim's context. No public proof-of-concept is identified in the provided data.