CVE-2026-12141 is a stored cross-site scripting vulnerability in the Premium Addons for Elementor plugin for WordPress. It occurs due to improper neutralization of input in the 'premium_tooltip_text' parameter, allowing authenticated contributors or higher to inject arbitrary scripts. These scripts execute when privileged users open the affected post in the Elementor editor because the plugin outputs raw, unescaped content via the print_template() method hooked to 'elementor/section/print_template'. This vulnerability does not affect the public frontend but targets the editor interface, potentially enabling privilege escalation or further attacks within the admin context.

An attacker with contributor-level or higher privileges can inject malicious scripts that execute in the context of administrators or other high-privileged users when they open the affected post in the Elementor editor. This can lead to limited confidentiality and integrity impacts within the admin environment, such as session hijacking or unauthorized actions. The vulnerability does not impact availability and does not affect the public frontend, limiting the scope of exploitation.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict contributor-level access to trusted users only and avoid opening posts in the Elementor editor that may contain untrusted content in the 'premium_tooltip_text' parameter. Monitor vendor channels for updates and apply patches promptly once released.