EUVD-2026-57108
GHSA-p7cg-pvwq-8wxg
Severity by source
AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Contributor role required (PR:L); victim must load the page (UI:R); injected script runs in victim browser scope (S:C), enabling session theft (C:L) and DOM manipulation (I:L) with no availability impact.
Primary rating from Vendor (WPScan).
CVSS VectorVendor: WPScan
Lifecycle Timeline
4DescriptionCVE.org
The Royal Addons for Elementor WordPress plugin before 1.7.1065 does not validate a widget setting used to build an HTML tag before outputting it, which could allow users with the Contributor role and above to perform Stored Cross-Site Scripting attacks.
AnalysisAI
Stored Cross-Site Scripting in the Royal Addons for Elementor WordPress plugin (all versions before 1.7.1065) allows authenticated users holding the Contributor role or higher to inject persistent malicious scripts by supplying an unsanitized value in a widget setting that is written directly into an HTML tag. When a higher-privileged user such as an administrator subsequently views the affected page, the injected script executes in their browser session. A publicly available proof-of-concept exists and EPSS is 15%, placing this above the median exploitation probability for medium-severity WordPress plugin flaws.
Technical ContextAI
Royal Addons for Elementor is a third-party addon for the Elementor page-builder WordPress plugin, identified by CPE cpe:2.3:a:unknown:royal_addons_for_elementor:*:*:*:*:*:*:*:*. The vulnerability is rooted in CWE-79 (Improper Neutralization of Input During Web Page Generation), specifically the stored variant: a widget exposes a configurable setting that is concatenated unsanitized into an HTML tag attribute (or tag name) before being persisted and later rendered server-side. Elementor's widget framework allows contributors to create and publish page content, meaning plugin authors must sanitize and validate any widget option that influences tag construction - a sanitize_html_class, esc_attr, or allowlist approach would neutralize the flaw. The absence of such validation is the root cause.
RemediationAI
The primary fix is to update the Royal Addons for Elementor plugin to version 1.7.1065 or later, where the widget setting is properly validated before being used in HTML tag construction. Site administrators should apply this update immediately via the WordPress dashboard or WP-CLI. If immediate patching is not possible, a targeted compensating control is to restrict user registration and role assignment - specifically, prevent untrusted users from being assigned the Contributor role or higher, since exploitation requires at minimum that role. On multisite or membership-based installations where Contributors are broadly granted, consider temporarily disabling the specific affected widget type until the patch can be applied; note this will break any pages using that widget. Generic WAF rules targeting script injection patterns may reduce automated PoC attempts but are not reliable against crafted payloads. Reference the WPScan advisory at https://wpscan.com/vulnerability/c27c1dcd-a6d2-4e1d-a9da-88dff8fe5618/ for widget-specific details.
More in Royal Addons For Elementor
View allStored Cross-Site Scripting in the Royal Addons for Elementor WordPress plugin (all versions before 1.7.1066) permits an
Arbitrary PHP code execution in Royal Addons for Elementor WordPress plugin (all versions before 1.7.1066) is reachable
HTML injection in the Royal Elementor Addons WordPress plugin before version 1.7.1067 lets unauthenticated visitors inje
Unauthenticated information disclosure in Royal Addons for Elementor (WordPress plugin) before version 1.7.1066 exposes
Unauthenticated metadata tampering in Royal Addons for Elementor WordPress plugin before 1.7.1066 allows any remote visi
Royal Addons for Elementor WordPress plugin before 1.7.1063 exposes private and draft Elementor template content to unau
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today