What is the CVSS score of CVE-2026-27421?

CVE-2026-27421 has a CVSS 3.1 base score of 6.5 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L. EPSS exploitation probability: 0.0%.

Is there a patch available for CVE-2026-27421?

Yes, a patch is available for CVE-2026-27421. Update the affected software to the latest version immediately.

Royal Elementor Addons CVE-2026-27421

EUVD-2026-28338 MEDIUM

Cross-site Scripting (XSS) (CWE-79)

2026-05-07 Patchstack

GHSA-h3xh-5g78-fc7p

XSS Royal Elementor Addons Elementor

6.5

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

6.5 MEDIUM

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

Required

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

Low

Lifecycle Timeline

Patch available

May 07, 2026 - 10:16 EUVD

Analysis Generated

May 07, 2026 - 09:00 vuln.today

CVE Published

May 07, 2026 - 07:31 nvd

MEDIUM 6.5

DescriptionCVE.org

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WProyal Royal Elementor Addons allows Stored XSS.

This issue affects Royal Elementor Addons: from n/a before 1.7.1053.

AnalysisAI

Stored cross-site scripting (XSS) in WProyal Royal Elementor Addons before version 1.7.1053 allows authenticated users with limited privileges to inject malicious scripts into web pages, which execute in the browsers of site visitors. The vulnerability requires user interaction (UI:R in CVSS) and is limited to users with login credentials (PR:L), but once stored, affects all visitors regardless of their privileges. An attacker with contributor or editor access can compromise website visitors, steal session cookies, or perform actions on their behalf.

Technical ContextAI

Royal Elementor Addons is a WordPress plugin that extends the Elementor page builder with additional widgets and functionality. The vulnerability stems from improper neutralization of user input during web page generation (CWE-79), a classic stored XSS flaw where user-supplied content is saved to the database and rendered without adequate HTML encoding or sanitization. When stored content is retrieved and displayed to site visitors, the injected script executes in their browsers within the context of the website domain (Scope:Changed in CVSS), allowing cross-site request forgery, credential theft, or malware injection. The plugin processes user input (likely through Elementor widget settings or custom fields) without applying proper output escaping functions required by WordPress security standards.

RemediationAI

Update Royal Elementor Addons to version 1.7.1053 or later immediately. In the WordPress admin dashboard, navigate to Plugins, find 'Royal Elementor Addons', and click 'Update' if available, or deactivate and delete the plugin if immediate updating is not possible. Administrators should verify that only trustworthy users have contributor or editor role access, as these permissions can be exploited to inject XSS payloads. As a temporary compensating control if upgrading is delayed, disable user editing capabilities for untrusted accounts, restrict editor roles to administrators only, or use a WordPress security plugin with input validation and output escaping filters to sanitize Elementor widget content. Review published posts and pages created by non-admin users for suspicious scripts or unusual widget configurations, as stored XSS may already be present. See Patchstack advisory for detailed update instructions: https://patchstack.com/database/wordpress/plugin/royal-elementor-addons/vulnerability/wordpress-royal-elementor-addons-plugin-1-7-1053-cross-site-scripting-xss-vulnerability