PT-2026-57387 · WordPress · Premium Addons For Elementor

Chloe Chamberland + 1 · Published 2026-07-11 · Updated 2026-07-11 · CVE-2026-12141

Positive Technologies (AI Summary)

CVSS v3.1

4.9

Medium

Base vector

AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Premium Addons for Elementor – Powerful Elementor Templates & Widgets versions prior to 4.11.85

Description Stored Cross-Site Scripting occurs due to insufficient input sanitization and output escaping. Authenticated attackers with contributor-level access or higher can inject arbitrary web scripts through the premium tooltip text parameter. The payload executes when an administrator or a higher-privileged user opens the affected post in the Elementor editor, as the raw unescaped output is processed via the print template() function registered on the elementor/section/print template hook.

Recommendations Update to version 4.11.85 or later. As a temporary mitigation, restrict access to the premium tooltip text parameter for users with contributor-level permissions.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2026-12141

Affected Products

Premium Addons For Elementor

References · 8

• https://nvd.nist.gov/vuln/detail/CVE-2026-12141 · Security Note
• https://plugins.trac.wordpress.org/browser/premium-addons-for-elementor/tags/4.11.82/addons/tooltips.php#L251 · Note
• https://plugins.trac.wordpress.org/changeset?reponame=&old=3597629%40premium-addons-for-elementor&new=3597629%40premium-addons-for-elementor · Note
• https://plugins.trac.wordpress.org/browser/premium-addons-for-elementor/tags/4.11.82/addons/tooltips.php#L68 · Note
• https://twitter.com/infoflowcloud/status/2075871789117325813 · Twitter Post
• https://wordfence.com/threat-intel/vulnerabilities/id/867a0742-4fa9-4473-8d51-9abb6ec353a8?source=cve · Note
• https://plugins.trac.wordpress.org/browser/premium-addons-for-elementor/tags/4.11.82/addons/tooltips.php#L984 · Note
• https://twitter.com/CVEnew/status/2075869804511080593 · Twitter Post