CVE-2026-12141

Name of the Vulnerable Software and Affected Versions Premium Addons for Elementor – Powerful Elementor Templates & Widgets versions prior to 4.11.85

Description Stored Cross-Site Scripting occurs due to insufficient input sanitization and output escaping. Authenticated attackers with contributor-level access or higher can inject arbitrary web scripts through the premium tooltip text parameter. The payload executes when an administrator or a higher-privileged user opens the affected post in the Elementor editor, as the raw unescaped output is processed via the print template() function registered on the elementor/section/print template hook.

Recommendations Update to version 4.11.85 or later. As a temporary mitigation, restrict access to the premium tooltip text parameter for users with contributor-level permissions.