CVE-2026-12141 Overview
CVE-2026-12141 is a Stored Cross-Site Scripting (XSS) vulnerability [CWE-79] in the Premium Addons for Elementor – Powerful Elementor Templates & Widgets plugin for WordPress. The flaw affects all versions up to and including 4.11.84. It stems from insufficient input sanitization and output escaping of the premium_tooltip_text parameter. Authenticated attackers with contributor-level access or above can inject arbitrary web scripts into pages. The payload executes when an administrator or higher-privileged user opens the affected post in the Elementor editor.
Critical Impact
Contributor-level accounts can plant scripts that execute in an administrator's browser session, enabling account takeover through the Elementor editor context.
Affected Products
- Premium Addons for Elementor plugin for WordPress
- All versions up to and including 4.11.84
- WordPress sites running the Elementor page builder with this plugin enabled
Discovery Timeline
- 2026-07-11 - CVE-2026-12141 published to the National Vulnerability Database (NVD)
- 2026-07-14 - Last updated in NVD database
Technical Details for CVE-2026-12141
Vulnerability Analysis
The vulnerability resides in the tooltip addon of the Premium Addons for Elementor plugin. The premium_tooltip_text parameter accepts user-supplied HTML content without adequate sanitization. Output from this parameter is rendered without proper escaping through the print_template() method. This method is registered on the elementor/section/print_template hook, which runs inside the Elementor editor context.
Because the unescaped output occurs in the editor rather than on the public frontend, exploitation requires a higher-privileged user to open the malicious post for editing. An attacker with contributor-level access injects a payload into the tooltip text field of a page or post. When an administrator later opens that content in the Elementor editor, the injected JavaScript executes in the administrator's authenticated browser session.
Root Cause
The root cause is missing input sanitization on write and missing output escaping on render for the premium_tooltip_text parameter. The plugin trusts the tooltip text value and emits it into the editor template without applying WordPress escaping functions such as esc_html() or wp_kses().
Attack Vector
An authenticated attacker with contributor or higher privileges creates or edits a post using the Premium Tooltip widget. The attacker supplies a JavaScript payload in the premium_tooltip_text field. The malicious content is stored in the WordPress database. When a reviewer, editor, or administrator opens the post in the Elementor editor, the print_template() method outputs the payload unescaped, triggering script execution under the reviewer's session. See the Wordfence Vulnerability Analysis and the vulnerable source at WordPress Tooltip Addon Code for technical details.
Detection Methods for CVE-2026-12141
Indicators of Compromise
- Post or page content containing <script> tags, onerror=, onload=, or javascript: handlers stored in Elementor _elementor_data post meta fields.
- Unexpected outbound requests originating from administrator browser sessions immediately after opening posts in the Elementor editor.
- New administrator accounts or modified user roles created shortly after an editor session on a contributor-authored post.
Detection Strategies
- Scan the wp_postmeta table for _elementor_data entries containing suspicious strings in premium_tooltip_text fields.
- Review WordPress audit logs for contributor accounts that added or edited Premium Tooltip widgets.
- Inspect installed plugin versions and flag any Premium Addons for Elementor build at or below 4.11.84.
Monitoring Recommendations
- Monitor for anomalous administrative actions (user creation, role changes, plugin installs) that follow content edits by low-privileged users.
- Alert on browser-based network requests from /wp-admin/ sessions that hit unfamiliar external domains.
- Track changes to plugin files under wp-content/plugins/premium-addons-for-elementor/ to detect tampering.
How to Mitigate CVE-2026-12141
Immediate Actions Required
- Update Premium Addons for Elementor to a version later than 4.11.84 as soon as the vendor releases a patched build.
- Audit all contributor and author accounts, removing any that are unused or unrecognized.
- Review recent posts that use the Premium Tooltip widget for unexpected script content before opening them in the Elementor editor.
Patch Information
The vulnerable code paths are documented in the plugin's source at tooltips.php line 68, line 251, and line 984. Refer to the WordPress Change Set Details for the vendor's remediation commit.
Workarounds
- Temporarily restrict contributor-level and author-level accounts from using the Premium Tooltip widget through role management plugins.
- Deactivate the Premium Addons for Elementor plugin until an updated version can be installed on affected sites.
- Require editorial review of contributor-submitted posts in a plain WordPress editor before opening them in Elementor.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
