Royal Addons CVE-2026-107098

Requires an authenticated account with the Contributor role or above on the target WordPress site, and the attacker must build/edit content using this plugin's Elementor map widget, placing a payload in one of that widget's size settings. The payload only fires when another user renders the affected page - the description specifically calls out an administrator reviewing a pending submission (i.e., user interaction is required, UI:R). Limiting factors: exploitation is gated by the need for a valid Contributor-level (or higher) account, by a victim actually viewing the attacker's content, by use of the map widget, and by running a version in the 1.7.1037-to-before-1.7.1070 range; sites updated to 1.7.1070 are not affected.

This is a stored (persistent) cross-site scripting flaw (CWE-79) carrying a medium CVSS 3.1 base score of 6.8 (AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H). The supporting exploitation signals are weak: EPSS is only 0.17% (6th percentile), there is no CISA KEV listing, and no public exploit identified at time of analysis - the only references are the WPScan advisory and the NVD record. The vuln.today decision label is 'this_month', consistent with a real-but-non-emergency issue rather than an active threat. Two data conflicts should be flagged explicitly: (1) the CVSS vector states PR:H (high privilege) yet the description says the flaw is reachable by the 'Contributor role or above', which is a LOW-privilege authenticated role - PR:L would better fit the described mechanism; verify with WPScan/vendor. (2) The input assigns full C:H/I:H/A:H impact, which is aggressive for a reflected-into-admin stored XSS; typical impact is limited integrity/confidentiality against the viewing user's session rather than full availability loss. Net: a genuine authenticated stored-XSS requiring a victim admin to view attacker content - worth patching on a normal cycle, not an emergency, and not a mass-exploitation candidate given the low EPSS and privilege/interaction prerequisites.

A user holding the Contributor role (or higher) edits or submits a page that uses the plugin's map widget and places a JavaScript payload into one of the map widget's size settings, which is concatenated into an HTML attribute without sanitisation or escaping. When an administrator (or any user) later views that page - for example while reviewing the pending submission - the injected script executes in their authenticated browser session, enabling session/account abuse or further administrative actions. No public exploit code is identified at time of analysis.