# CVE-2026-125762: LeapWorx Premium Addons for Elementor stored cross-site scripting

Source: https://junglewise.ai/threats/cve-2026-125762-improper-neutralization-of-input-during-web-page-generation  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-11-11. Updated: 2026-11-11  
License: CC BY 4.0 with a link back

CVE-2026-125762 · Severity: medium · CVSS 6.5 · Published 2026-11-11

Premium Addons for Elementor is a WordPress plugin that extends the Elementor page builder with additional widgets and functionality. A stored cross-site scripting (XSS) vulnerability in the plugin allows authenticated attackers to inject malicious scripts that execute in visitors' browsers, potentially stealing their data or hijacking their accounts.

Technologies: [LeapWorx Premium Addons for Elementor](https://junglewise.ai/threats/technologies/leapworx-premium-addons-for-elementor). Vendors: [LeapWorx](https://junglewise.ai/threats/vendors/leapworx).

## Quick answers

**Is CVE-2026-125762 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-125762 being exploited in the wild.

**How severe is CVE-2026-125762?** Medium severity, with a CVSS score of 6.5, published 11 November 2026.

**Which products and versions are affected?** LeapWorx Premium Addons for Elementor through 4.11.116.

**Is there a fix for CVE-2026-125762?** Yes: fixed in 4.11.117. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-125762 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-125762?** Check whether you run LeapWorx Premium Addons for Elementor at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in 4.11.117

## Technical details

A stored XSS vulnerability exists in Premium Addons for Elementor through version 4.11.116 due to improper input neutralization during web page generation. The flaw requires a contributor or developer role to inject the payload, but once stored, the malicious script executes in the browsers of all site visitors who view the affected content. This can lead to credential theft, session hijacking, or malware distribution.

## Affected products

- LeapWorx Premium Addons for Elementor through 4.11.116

## Timeline

- 2026-11-11: disclosed

## References

- [https://wordpress.org/plugins](https://wordpress.org/plugins)
- [https://patchstack.com/database/wordpress/plugin/premium-addons-for-elementor/vulnerability/wordpress-premium-addons-for-elementor-plugin-4-11-116-cross-site-scripting-xss-vulnerability?_s_id=cve](https://patchstack.com/database/wordpress/plugin/premium-addons-for-elementor/vulnerability/wordpress-premium-addons-for-elementor-plugin-4-11-116-cross-site-scripting-xss-vulnerability?_s_id=cve)

## Related threats

- [LeapWorx Premium Addons for Elementor broken access control](https://junglewise.ai/threats/cve-2026-109890-missing-authorization-vulnerability-in-leapworx-premium-addons)
- [LeapWorx Premium Addons for Elementor stored cross-site scripting](https://junglewise.ai/threats/cve-2026-108490-improper-neutralization-of-input-during-web-page-generation)
- [LeapWorx Premium Addons for Elementor stored XSS](https://junglewise.ai/threats/cve-2026-108482-improper-neutralization-of-input-during-web-page-generation)
- [LeapWorx Premium Addons for Elementor stored XSS](https://junglewise.ai/threats/cve-2026-103084-improper-neutralization-of-input-during-web-page-generation)
- [Premium Addons for Elementor stored cross-site scripting](https://junglewise.ai/threats/cve-2026-62078-contributor-cross-site-scripting-xss-in-premium-addons-for)