Royal Elementor Addons CVE-2026-112865

Exploitation requires an authenticated WordPress account with at least low-level privileges (per CVSS PR:L) on a site running Royal Elementor Addons up to and including version 1.7.1069, plus user interaction (UI:R) - a victim must load or view the page into which the DOM-based payload is injected. The specific plugin feature, parameter, or input field that is improperly neutralized is not described in the available sources, so the exact injection point cannot be named from the provided data. Limiting factors that reduce realistic risk: the attacker must already be authenticated, a separate victim must interact with the malicious content, and impact is confined to in-browser script execution (C:L/I:L/A:L) rather than server-side compromise.

This is a moderate-risk, not high-priority, issue when all signals are weighed together. The CVSS 3.1 base score is 6.5 (Medium) with vector AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L: network-reachable and low-complexity, but it requires an authenticated account (PR:L) and victim user interaction (UI:R), and impact across confidentiality, integrity and availability is only Low. The scope-changed flag (S:C) reflects that injected script executes in a different security context (the victim's browser session) rather than a system-level compromise. No EPSS score, no CISA KEV listing, and no SSVC automatable/technical-impact values were supplied, so machine-readable exploitation-probability signals are absent; the only priority signal is the vuln.today 'this_month' decision label and the Patchstack report, which together frame this as a routine patch-cycle item rather than an emergency. There is no confirmed active exploitation and no verified working exploit code. The dependency on both prior authentication and user interaction substantially limits real-world weaponization, so this is a genuine-but-low-urgency web-application flaw rather than a high-CVSS issue masking critical risk. Note the typical caveat for WordPress plugin XSS: PR:L here implies a low-privileged authenticated role (e.g., contributor/author) is needed, which the description does not explicitly state - the privilege requirement is taken from the CVSS vector, not the text.

A low-privileged authenticated user (such as a contributor) of a WordPress site running Royal Elementor Addons supplies crafted input through an affected plugin feature that is later rendered unsafely in the DOM. When an administrator or another user views the resulting page, the attacker-controlled script executes in that victim's browser session, enabling session/context abuse within the site. No public exploit code is confirmed; the only reference is the Patchstack advisory entry.