Premium Addons for Elementor plugins up to version 4.11.105 contain an unvalidated input field that permits a malicious actor to inject arbitrary script into the page rendered for site visitors. The flaw is an input validation error catalogued as CWE‑79. An attacker can exploit the vulnerability to run code in the context of the victim’s browser session, potentially enabling credential theft, defacement, or further compromise of the target site.

The vulnerability affects WordPress installations that have Leap13's Premium Addons for Elementor plugin at version 4.11.105 or older. No other WordPress plugin or core component is listed as impacted.

The CVSS base score of 6.5 indicates moderate severity. The absence of an EPSS score and lack of inclusion in CISA KEV suggest that large‑scale exploitation has not yet been observed. The likely attack vector is an unauthenticated submission of crafted content via the plugin’s edit interface, which does not require elevated host privileges. Attackers who can create or modify plugin content can trigger the XSS, affecting all users that view the altered content.