CVE · Medium
| CVE | Vulnerability | Type | Severity | Affected | Fixed in | Published | Status |
|---|---|---|---|---|---|---|---|
| CVE-2026-4790 | Premium Addons for Elementor – Elementor Templates, Widgets & MCP Tools [premium-addons-for-elementor] < 4.11.71 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | Medium 5.4 | < 4.11.71 | 4.11.71 | 2026-05-01 | — |
The Premium Addons for Elementor plugin, versions 4.11.70 and earlier, is susceptible to stored cross-site scripting (XSS) attacks through the 'custom_svg' parameter. Authenticated users with at least contributor permissions can inject malicious scripts that will run in other users' browsers when they view affected pages.
Based on public CVE data (MITRE/NVD).
No signup, no credit card — enter your URL and get a security report in seconds.