EUVD-2026-66275
GHSA-5xmp-jf4j-v6qw
Severity by source
AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H
Contributor is a standard low-privilege authenticated role (PR:L, not PR:H); all other metrics align with the provided vector.
Primary rating from Vendor (WPScan).
CVSS VectorVendor: WPScan
Lifecycle Timeline
5DescriptionCVE.org
The Royal Addons for Elementor WordPress plugin before 1.7.1066 does not validate some widget settings before outputting them inside an HTML attribute, which could allow users with the Contributor role and above to perform Stored Cross-Site Scripting attacks.
AnalysisAI
Stored Cross-Site Scripting in the Royal Addons for Elementor WordPress plugin (all versions before 1.7.1066) permits any authenticated Contributor-role user to inject arbitrary JavaScript payloads via unsanitized widget settings that are rendered unescaped inside HTML attributes. When a higher-privileged user such as an administrator previews or views the crafted content, the payload executes in their browser session, enabling session hijacking, credential theft, or unauthorized administrative actions. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires an authenticated WordPress session with at minimum the Contributor role on the target installation; anonymous or subscriber-level users cannot trigger the vulnerability. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The provided CVSS 3.1 vector CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H yields 6.8, but the PR:H assignment warrants scrutiny: the Contributor role in WordPress is a standard low-privilege authenticated account, not an administrative one, making PR:L a more accurate independent assessment - which would push the base score toward 8.0. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Update Royal Addons for Elementor to version 1.7.1066 or later using the WordPress Plugins dashboard (Plugins → Updates) or by downloading directly from the WordPress.org plugin repository; the vendor-released patch is confirmed available per the WPScan advisory at https://wpscan.com/vulnerability/1454d76e-c90b-40b3-b0b8-fb9a25ffb183/. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Royal Addons For Elementor
View allStored Cross-Site Scripting in the Royal Addons for Elementor WordPress plugin (all versions before 1.7.1065) allows aut
Arbitrary PHP code execution in Royal Addons for Elementor WordPress plugin (all versions before 1.7.1066) is reachable
Unauthenticated information disclosure in Royal Addons for Elementor (WordPress plugin) before version 1.7.1066 exposes
Unauthenticated metadata tampering in Royal Addons for Elementor WordPress plugin before 1.7.1066 allows any remote visi
Royal Addons for Elementor WordPress plugin before 1.7.1063 exposes private and draft Elementor template content to unau
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today