CVE-2026-108490: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in LeapWorx Premium Addons for Elementor

This vulnerability in LeapWorx Premium Addons for Elementor involves improper neutralization of input during web page generation, leading to stored cross-site scripting (XSS). The flaw affects all versions from initial release through 4.11.110. Exploitation requires user interaction and low privileges but can result in partial confidentiality, integrity, and availability impact. No known exploits are reported in the wild. The CVSS 3.1 vector is AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L.

Successful exploitation could allow an attacker to execute arbitrary scripts in the context of the affected web application, potentially leading to partial disclosure of information, modification of data, or disruption of service. The vulnerability requires user interaction and low privileges, limiting the attack scope somewhat. There are no reports of active exploitation in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official patch or fix link is provided, users should monitor vendor communications for updates. Until a fix is available, consider restricting user input or applying web application firewall rules to detect and block malicious payloads related to stored XSS.