Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in LeapWorx Premium Addons for Elementor… (CVE-2026-108482)

CVE-2026-108482 describes a stored cross-site scripting (XSS) vulnerability in LeapWorx Premium Addons for Elementor. The vulnerability arises from improper neutralization of input during web page generation, allowing malicious scripts to be stored and executed in the context of affected web pages. This affects Premium Addons for Elementor versions up to and including 4.11.110. The CVSS 3.1 base score is 6.5, reflecting network attack vector, low attack complexity, requiring privileges and user interaction, with impacts on confidentiality, integrity, and availability.

Successful exploitation of this vulnerability could allow an attacker with low privileges to execute arbitrary scripts in the context of users visiting affected web pages. This can lead to partial compromise of confidentiality, integrity, and availability of the affected system or user data. However, no known exploits are reported in the wild at this time.

No official patch or remediation information is provided in the available data. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, consider restricting privileges and user inputs where possible to reduce risk.