Premium Addons CVE-2026-108490

Requires an authenticated WordPress account with at least low-level privileges (PR:L, typically contributor/author who can edit content containing the plugin's widgets) plus a victim viewing the injected content (UI:R). The payload is stored through an unsanitized Premium Addons for Elementor input field. Limiting factors: the attacker must already have a posting-capable account, so single-author or tightly controlled sites face little exposure, while multi-author or open-registration sites granting content-editing roles are most at risk. Affects versions from n/a through 4.11.110.

This is a moderate-severity stored XSS (CVSS 6.5, CWE-79) in a very widely deployed WordPress plugin, but the real-world urgency is lower than the raw score suggests. The CVSS vector (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L) shows network reach and low complexity, but two meaningful gates: PR:L requires an authenticated account (typically contributor/author level in Patchstack's WordPress methodology) and UI:R requires a victim to view the injected content. No EPSS score, KEV listing, or POC was provided in the input; consequently exploitation status is 'no public exploit identified at time of analysis.' There is no SSVC decision data supplied. The scope change (S:C) and low C/I/A reflect the classic stored-XSS pattern where attacker-controlled script executes in another user's browser session rather than compromising the server directly. Net assessment: a credible but not critical issue - prioritize as routine patch management rather than emergency response, with elevated attention for multi-author sites where low-privilege accounts are untrusted. No signals conflict; the main limitation is absence of EPSS/KEV/POC telemetry to gauge active interest.

An attacker with a low-privilege authenticated account (e.g., contributor) on a WordPress site running Premium Addons for Elementor injects a malicious JavaScript payload into a plugin-controlled input field, which is stored unsanitized. When an administrator or other user later views the page or post containing that widget, the script executes in their browser session, enabling session-cookie theft or actions on their behalf. No public exploit code was identified in the provided data.