What is the CVSS score of CVE-2026-40720?

CVE-2026-40720 has a CVSS 3.1 base score of 7.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L. EPSS exploitation probability: 0.2%.

Which versions of Royal Elementor Addons Pro are affected by CVE-2026-40720?

Royal Elementor Addons Pro WordPress plugin contains an unauthenticated cross-site scripting vulnerability affecting versions prior to 1.7.1041 that allows remote attackers to inject malicious…

How to fix or mitigate CVE-2026-40720?

Within 24 hours: Identify all WordPress installations running Royal Elementor Addons Pro and document current plugin versions in use. Within 7 days: Upgrade all affected instances to version 1.7.1041 or later; test functionality in staging environments before deploying to production. Within 30 days: Confirm successful patching across all installations and review WordPress access logs and admin activity for signs of exploitation.

Royal Elementor Addons Pro CVE-2026-40720

HIGH

Cross-site Scripting (XSS) (CWE-79)

2026-06-17 Patchstack

XSS Royal Elementor Addons Pro Elementor

7.1

CVSS 3.1 · Vendor: Patchstack

Severity by source

Vendor (Patchstack) PRIMARY

7.1 HIGH

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L

vuln.today AI

7.1 HIGH

Unauthenticated network-reachable XSS requiring victim click (UI:R), with scope change to the browser context and limited C/I/A impact typical of reflected XSS.

3.1 AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L

4.0 AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N

Primary rating from Vendor (Patchstack).

CVSS VectorVendor: Patchstack

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

Low

Lifecycle Timeline

Analysis Generated

Jun 17, 2026 - 14:33 vuln.today

DescriptionCVE.org

Unauthenticated Cross Site Scripting (XSS) in Royal Elementor Addons Pro < 1.7.1041 versions.

AnalysisAI

Unauthenticated reflected/stored cross-site scripting in Royal Elementor Addons Pro WordPress plugin versions prior to 1.7.1041 allows remote attackers to inject arbitrary JavaScript that executes in a victim's browser when they interact with a crafted link or page. No public exploit identified at time of analysis, but the unauthenticated nature combined with the popularity of Elementor-ecosystem plugins makes this a credible threat to WordPress sites running the Pro variant. Patchstack disclosure indicates a fixed version is available.

Technical ContextAI

Royal Elementor Addons Pro (CPE: cpe:2.3:a:royal_elementor_addons:royal_elementor_addons_pro) is a commercial premium add-on suite for the Elementor page builder on WordPress, providing widgets, templates, and dynamic content modules. The flaw maps to CWE-79 (Improper Neutralization of Input During Web Page Generation), meaning user-controlled input is rendered into HTML/JavaScript context without adequate encoding or sanitization. In WordPress plugin ecosystems, such issues typically arise in widget shortcode attributes, AJAX endpoints, or query-parameter-driven rendering paths that reflect attacker data into the DOM.

RemediationAI

Vendor-released patch: upgrade Royal Elementor Addons Pro to version 1.7.1041 or later via the WordPress plugin update mechanism or by downloading the latest build from the vendor account portal, per the Patchstack advisory at https://patchstack.com/database/wordpress/plugin/wpr-addons-pro/vulnerability/wordpress-royal-elementor-addons-pro-plugin-1-7-1041-cross-site-scripting-xss-vulnerability. If immediate patching is not possible, deploy a WAF rule (Patchstack, Wordfence, or equivalent) to filter script-injection patterns against the plugin's endpoints and shortcode parameters; restrict editor/admin sessions to a hardened browser profile to limit damage from successful payload execution; and consider temporarily deactivating the Pro plugin on internet-exposed sites if it is not actively in use, accepting the trade-off of losing Royal-specific widgets and templates until the update is applied.