What is the CVSS score of CVE-2026-4790?

CVE-2026-4790 has a CVSS 3.1 base score of 5.4 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N. EPSS exploitation probability: 0.0%.

Premium Addons for Elementor CVE-2026-4790

EUVD-2026-26783 MEDIUM

Cross-site Scripting (XSS) (CWE-79)

2026-05-02 Wordfence

WordPress XSS Elementor

5.4

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

5.4 MEDIUM

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

Required

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

May 02, 2026 - 12:31 vuln.today

EUVD ID Assigned

May 02, 2026 - 12:00 euvd

EUVD-2026-26783

Analysis Generated

May 02, 2026 - 12:00 vuln.today

CVE Published

May 02, 2026 - 11:16 nvd

MEDIUM 5.4

DescriptionCVE.org

The Premium Addons for Elementor - Powerful Elementor Templates & Widgets plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'custom_svg' parameter in versions up to, and including, 4.11.70 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

AnalysisAI

Stored Cross-Site Scripting in Premium Addons for Elementor plugin for WordPress up to version 4.11.70 allows authenticated attackers with contributor-level or higher privileges to inject arbitrary JavaScript via the 'custom_svg' parameter, which executes in the browsers of users viewing the affected pages. The vulnerability stems from insufficient input sanitization and output escaping on a user-controllable SVG parameter. No public exploit code or active exploitation has been identified at the time of analysis.

Technical ContextAI

The Premium Addons for Elementor plugin is a WordPress extension that provides additional Elementor page builder templates and widgets. The vulnerability exists in the handling of the 'custom_svg' parameter, which appears to accept and render user-supplied SVG content without proper sanitization or escaping. SVG elements are XML-based and can contain embedded JavaScript (via event handlers such as onload, onerror, or script tags), making them a common XSS vector when user input is not strictly validated. The CWE-79 classification (Improper Neutralization of Input During Web Page Generation) confirms that the root cause is the failure to sanitize untrusted input before rendering it in HTML/XML context. The plugin's use of this parameter in page templates means injected content persists in the WordPress database and executes for all subsequent page visitors, elevating the attack from reflected to stored XSS.

RemediationAI

Update Premium Addons for Elementor to version 4.11.71 or later immediately. The patch is available via the official WordPress plugin repository and should be deployed through the WordPress admin dashboard (Plugins → Installed Plugins → Premium Addons for Elementor → Update). Verify the update by checking the plugin version and confirming it displays 4.11.71 or higher in the Plugins page. For organizations unable to immediately patch, restrict the contributor role to trusted users only via WordPress user role management (WordPress Dashboard → Users → Edit → Role), or temporarily deactivate the plugin until the update can be applied. Note that deactivating the plugin will disable all Premium Addons functionality and custom layouts until reactivation. Additionally, conduct a site-wide content audit (Posts → Search for pages containing custom SVG elements injected by untrusted contributors) to identify and remove any stored XSS payloads that may have been introduced prior to patching. Use WordPress security plugins (e.g., Wordfence, iThemes Security) to scan for malicious SVG content and malware.