CVE-2026-12141: Premium Addons for Elementor Authenticated Stored XSS

Vulnerability Overview Vulnerability Name: Premium Addons for Elementor <= 4.11.84 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'premium_tooltip_text' Parameter CVE ID: CVE-2026-12141 CVSS Score: 4.9 (Medium) Publication Date: July 10, 2026 Last Updated: July 11, 2026 Researchers: Chloe Chamberland - Wordfence, PRISM - Wordfence Scope of Impact Software Type: Plugin Software Name: Premium Addons for Elementor – Powerful Elementor Templates & Widgets Affected Versions: <= 4.11.84 Fixed Version: 4.11.85 Remediation Recommendation: Update to version 4.11.85 or later. Vulnerability Description Vulnerability Type: Stored Cross-Site Scripting (XSS) Root Cause: Injection of malicious scripts in the parameter due to insufficient input validation and output escaping. Trigger Conditions: The malicious script executes on the front end when an administrator or a user with higher privileges opens the affected page. Reference Links plugins.trac.wordpress.org Additional Information CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N Related Recent Vulnerabilities CVE-2026-4790: Premium Addons for Elementor <= 4.11.70 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'custom_svg' Parameter CVE-2025-69300: Premium Addons for Elementor <= 4.11.63 - Missing Authorization to Authenticated (Subscriber) Settings Update CVE-2025-14163: Premium Addons for Elementor <= 4.11.53 - Cross-Site Request Forgery via 'insert_inner_template' CVE-2025-14155: Premium Addons for Elementor <= 4.11.53 - Missing Authorization to Unauthenticated Sensitive Information Exposure via 'get_template_content' CVE-2025-68494: Premium Addons for Elementor <= 4.11.53 - Unauthenticated Information Exposure CVE-2024-11937: Premium Addons for Elementor <= 4.10.69 - Authenticated (Contributor+) Stored Cross-Site Scripting CVE-2024-4774: Premium Addons for Elementor <= 4.11.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via Countdown Widget CVE-2024-56225: Premium Addons for Elementor <= 4.10.56 - Missing Authorization CVE-2024-10266: Premium Addons for Elementor <= 4.10.60 - Authenticated (Contributor+) DOM-Based Stored Cross-Site Scripting via Video Box Widget CVE-2024-8681: Premium Addons for Elementor <= 4.10.52 - Authenticated (Contributor+) Stored Cross-Site Scripting via Media Grid Widget Notes Disclaimer: This record contains copyrighted material. Contact: For any errors or to request information additions, please contact . Other Services Wordfence Intelligence: Provides free personal and commercial API access to the WordPress vulnerability database. Wordfence WordPress Plugin: Notifies you instantly of the latest vulnerabilities that may affect your website. Documentation: Provides documentation on how to access and use the vulnerability database API. Contact Information Business Hours: 9am-8pm ET, 6am-5pm PT, and 2pm-1am UTC/GMT (excluding weekends and holidays) Response Time: 24/7 support with a 1-hour response time. Legal Information Terms of Service: Terms of Service Privacy Policy: Privacy Policy and Notice at Collection Data Sales: Do Not Sell or Share My Personal Information Social Media Twitter: Wordfence Facebook: Wordfence Instagram: Wordfence Products and Services Wordfence Free: Wordfence Free Wordfence Premium: Wordfence Premium Wordfence Care: Wordfence Care Wordfence Response: Wordfence Response Wordfence CLI: Wordfence CLI Wordfence Intelligence: Wordfence Intelligence Wordfence Central: Wordfence Central Support Documentation: Documentation Learning Center: Learning Center Free Support: Free Support Premium Support: Premium Support News Blog: Blog In The News: In The News Vulnerability Advisories: Vulnerability Advisories About About Wordfence: About Wordfence Affiliate Program: Affiliate Program Employment: Employment Contact: Contact Security: Security CVE Request Form: CVE Request Form Subscription Stay Updated: Sign up for news and updates from our panel of experienced security professionals. Copyright © 2012-2026 Defiant Inc. All Rights Reserved. Other Wordfence Intelligence: Wordfence Intelligence Summary Vulnerability Overview: Premium Addons for Elementor <= 4.11.84 contains a Stored Cross-Site Scripting vulnerability. Scope of Impact: Affected versions are <= 4.11.84; the fixed version is 4.11.85. Remediation: Update to version 4.11.85 or later.

Goal Reached Thanks to every supporter — we hit 100%!

CVE-2026-12141: Premium Addons for Elementor Authenticated Stored XSS