What is the CVSS score of CVE-2026-5159?

CVE-2026-5159 has a CVSS 3.1 base score of 6.4 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N. EPSS exploitation probability: 0.0%.

Royal Addons for Elementor CVE-2026-5159

EUVD-2026-27189 MEDIUM

Cross-site Scripting (XSS) (CWE-79)

2026-05-05 Wordfence

GHSA-6vmj-c5pc-9jfw

XSS WordPress Elementor

6.4

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

6.4 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

May 05, 2026 - 04:31 vuln.today

DescriptionCVE.org

The Royal Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Instagram Feed widget's 'instagram_follow_text' setting in all versions up to, and including, 1.7.1056 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Note that exploitation requires that an administrator has previously configured the Instagram Feed widget with a valid Instagram access token on the site.

AnalysisAI

Stored Cross-Site Scripting in Royal Addons for Elementor's Instagram Feed widget allows authenticated contributors and above to inject arbitrary JavaScript via the 'instagram_follow_text' setting, which executes in the browsers of all users viewing the affected page. The vulnerability affects all versions up to 1.7.1056 and requires the Instagram Feed widget to be previously configured with a valid access token by an administrator. No public exploit code or active exploitation has been confirmed at this time.

Technical ContextAI

The vulnerability exists in the Instagram Feed widget component of Royal Addons for Elementor, a WordPress plugin that extends Elementor page builder functionality. The flaw stems from insufficient input sanitization and output escaping of the 'instagram_follow_text' parameter in the widget settings, which is likely processed and rendered in the frontend without proper WordPress sanitization functions (wp_kses_post, sanitize_text_field) or escaping functions (esc_html, wp_kses_allowed_html). WordPress plugins must sanitize all user inputs and escape all dynamic output to prevent XSS. The attack vector is network-based with low complexity, leveraging the WordPress administrative interface where Contributor-level users can modify widget settings. CWE-79 (Improper Neutralization of Input During Web Page Generation) is the root cause classification.

RemediationAI

Update Royal Addons for Elementor to the latest patched version beyond 1.7.1056 immediately via the WordPress Plugins dashboard (Plugins > Installed Plugins > Royal Addons for Elementor > Update). As a temporary workaround if an immediate update is not possible, disable the Instagram Feed widget entirely by removing it from all pages and deactivating the plugin if not in use, or restrict Contributor-level access to only trusted users via WordPress role management (Settings > Users or User Role Editor plugin). Additionally, administrators should audit existing widget configurations for any suspicious content in the 'instagram_follow_text' field and review page revision history via WordPress Revisions feature to detect unauthorized modifications. Monitor site logs for editor-level user activity and consider enabling two-factor authentication (2FA) on all administrative accounts via a security plugin to prevent unauthorized access. The vulnerability is rooted in inadequate escaping in the widget rendering function; patches should include proper use of wp_kses_post() on input sanitization and esc_html() or esc_attr() on output escaping depending on context.