What is the CVSS score of CVE-2026-4803?

CVE-2026-4803 has a CVSS 3.1 base score of 7.2 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N. EPSS exploitation probability: 0.1%.

Which versions of Royal Elementor Addons are affected by CVE-2026-4803?

Royal Elementor Addons WordPress plugin versions up to 1.7.1056 contain a stored cross-site scripting vulnerability that allows unauthenticated attackers to inject malicious scripts affecting all…

How to fix or mitigate CVE-2026-4803?

Within 24 hours: inventory all WordPress instances running Royal Elementor Addons and identify current installed versions via plugin management interface. Within 7 days: disable or deactivate the plugin on all affected sites pending vendor patch release, or implement Web Application Firewall (WAF) rules blocking requests to the wpr_update_form_action_meta AJAX endpoint. Within 30 days: monitor vendor advisory channels for patch availability; apply vendor-released patch immediately upon release to all affected instances before re-enabling the plugin.

Royal Elementor Addons CVE-2026-4803

EUVD-2026-27185 HIGH

Cross-site Scripting (XSS) (CWE-79)

2026-05-05 Wordfence

XSS WordPress Elementor

7.2

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.2 HIGH

AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

May 05, 2026 - 04:31 vuln.today

DescriptionCVE.org

The Royal Elementor Addons plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'status' parameter in the wpr_update_form_action_meta AJAX action in all versions up to, and including, 1.7.1056. This is due to insufficient input sanitization and output escaping, combined with a publicly leaked nonce that allows unauthenticated access to the AJAX handler. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

AnalysisAI

Stored Cross-Site Scripting in Royal Elementor Addons WordPress plugin allows unauthenticated remote attackers to inject malicious scripts that execute in victim browsers. The vulnerability exists in all versions up to 1.7.1056 due to a publicly leaked static nonce that bypasses authentication checks for the wpr_update_form_action_meta AJAX endpoint. Combined with insufficient input sanitization on the 'status' parameter, attackers can inject persistent XSS payloads without authentication. EPSS data not provided; no CISA KEV listing indicates no confirmed widespread exploitation at time of analysis.

Technical ContextAI

This vulnerability affects the Royal Elementor Addons plugin (wproyal:royal_addons_for_elementor), a WordPress extension that enhances Elementor page builder functionality. The flaw is a CWE-79 (Improper Neutralization of Input During Web Page Generation) stored XSS issue in the form actions status management module. The vulnerable code path includes an AJAX handler (wpr_update_form_action_meta) registered in plugin.php that processes form metadata updates. The critical security failure is twofold: first, the nonce verification mechanism uses a static, publicly discoverable value rather than WordPress's built-in dynamic nonce system; second, user-supplied data in the 'status' parameter is stored in the database without proper sanitization and later rendered without output escaping. The WordPress plugin repository references show the vulnerable code in wpr-actions-status.php at lines 21 and 73, with the AJAX handler registration visible in plugin.php at line 613. The fix in changeset 3503219 addresses both the nonce weakness and input validation gaps.

RemediationAI

Immediately upgrade to Royal Elementor Addons version 1.7.1057 or later, which addresses both the nonce weakness and input sanitization issues per changeset 3503219 visible at https://plugins.trac.wordpress.org/changeset/3503219/royal-elementor-addons. Site administrators should access WordPress admin dashboard, navigate to Plugins → Installed Plugins, locate Royal Elementor Addons, and click Update Now. After patching, review form submission data and post/page content for suspicious JavaScript injection patterns (script tags, event handlers, data URIs) as existing malicious payloads will persist post-patch. If immediate patching is impossible, disable the Royal Elementor Addons plugin entirely until upgrade is feasible - partial mitigations like WAF rules are insufficient given the authentication bypass via leaked nonce. Disabling the plugin will break Elementor-dependent pages but prevents exploitation. For sites requiring continued operation, implement Web Application Firewall rules blocking requests to /wp-admin/admin-ajax.php with action=wpr_update_form_action_meta, though this may disrupt legitimate form functionality and does not address already-injected stored payloads. Audit user roles with form management permissions and review recent form submissions for anomalous content.