What is the CVSS score of CVE-2026-12141?

CVE-2026-12141 has a CVSS 3.1 base score of 4.9 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:L/A:N. EPSS exploitation probability: 0.2%.

Premium Addons for Elementor CVE-2026-12141

EUVD-2026-43142 MEDIUM

Cross-site Scripting (XSS) (CWE-79)

2026-07-11 Wordfence

GHSA-r293-726m-x33j

WordPress XSS Wordpress Plugin Premium Addons For Elementor Powerful Elementor Templates Widgets Leap13

4.9

CVSS 3.1 · Vendor: Wordfence

Severity by source

Vendor (Wordfence) PRIMARY

4.9 MEDIUM

AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:L/A:N

vuln.today AI

5.4 MEDIUM

Contributor access required (PR:L) and admin must actively open the post in Elementor editor (UI:R); official UI:N appears inconsistent with the editor-only trigger, so AC:L/UI:R better reflects the actual exploitation conditions.

3.1 AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:A/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N

Primary rating from Vendor (Wordfence).

CVSS VectorVendor: Wordfence

Attack Vector

Network

Attack Complexity

High

Privileges Required

Low

User Interaction

None

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 11, 2026 - 05:20 vuln.today

CVE Published

Jul 11, 2026 - 03:44 cve.org

MEDIUM 4.9

DescriptionCVE.org

The Premium Addons for Elementor - Powerful Elementor Templates & Widgets plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'premium_tooltip_text' parameter in all versions up to, and including, 4.11.84 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The injected payload is specifically triggered when an administrator or higher-privileged user opens the affected post in the Elementor editor, as the raw unescaped output occurs via the print_template() method registered on the 'elementor/section/print_template' hook rather than on the public-facing frontend.

AnalysisAI

Stored XSS in Premium Addons for Elementor (all versions ≤4.11.84) lets authenticated contributors plant persistent JavaScript payloads via the premium_tooltip_text parameter that execute specifically when an administrator opens the injected post in the Elementor editor - not on public-facing pages. The root cause is unescaped output in the print_template() method registered on the elementor/section/print_template hook, meaning the attack surface is confined to the Elementor editor backend. No public exploit or CISA KEV listing has been identified at time of analysis; however, the scope-changed CVSS rating reflects real privilege-escalation potential from contributor to admin session context.

Technical ContextAI

CWE-79 (Improper Neutralization of Input During Web Page Generation) describes the root cause: user-supplied input in the premium_tooltip_text parameter is persisted to the database without adequate sanitization and later rendered without output escaping inside the print_template() method in addons/tooltips.php (confirmed at lines 68, 251, and 984 in version 4.11.82 via WordPress.org trac). The critical distinction is the hook: elementor/section/print_template fires only during Elementor's editor-side rendering pipeline, not the public frontend renderer, so the payload never appears to anonymous visitors. The CPE cpe:2.3:a:leap13:premium_addons_for_elementor_-_powerful_elementor_templates_&_widgets:*:*:*:*:*:*:*:* identifies the vendor as Leap13. Because the Elementor editor loads widget templates as raw HTML for live preview, any unescaped stored value becomes executable script in the admin's browser context.

RemediationAI

A patch commit has been published to the WordPress.org plugin repository per the changeset at https://plugins.trac.wordpress.org/changeset?reponame=&old=3597629%40premium-addons-for-elementor&new=3597629%40premium-addons-for-elementor; however, the exact patched release version number is not explicitly confirmed in the available data - verify the current version in the WordPress plugin repository and update beyond 4.11.84 via the standard WordPress plugin update mechanism. As a compensating control prior to patching, restrict contributor-level user roles from Elementor editor access entirely; this eliminates the attack prerequisite but may disrupt legitimate editorial workflows. Additionally, administrators should avoid opening unfamiliar contributor-authored posts in the Elementor editor on unpatched installations. There is no indication of a workaround that targets the specific parameter without disabling contributor Elementor access more broadly.