Now officially on WordPress.org

CVE Database / CVE-2026-12141

CVE · Medium

CVE-2026-12141 — Premium Addons for Elementor – Elementor Templates, Widgets & MCP Tools [premium-addons-for-elementor] < 4.11.85

CVE Vulnerability Type Severity Affected Fixed in Published Status
CVE-2026-12141 Premium Addons for Elementor – Elementor Templates, Widgets & MCP Tools [premium-addons-for-elementor] < 4.11.85 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Medium 4.9 < 4.11.85 4.11.85 2026-07-10 —

CVE-2026-12141

The Premium Addons for Elementor plugin, up to version 4.11.84, is susceptible to a stored cross-site scripting (XSS) vulnerability through the 'premium_tooltip_text' parameter. Attackers with contributor-level access or higher can inject malicious scripts that will run when users view specific pages. These scripts are particularly triggered when an administrator or higher-privileged user opens affected posts in the Elementor editor, due to unescaped output from the print_template() method used on the 'elementor/section/print_template' hook.

Based on public CVE data (MITRE/NVD).

Scan your WordPress site free

No signup, no credit card — enter your URL and get a security report in seconds.

Run a free scan Get the plugin (free)

See the full security page for this plugin Browse the CVE database Browse all security findings