What is the CVSS score of CVE-2026-5162?

CVE-2026-5162 has a CVSS 3.1 base score of 6.4 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N. EPSS exploitation probability: 0.0%.

WordPress CVE-2026-5162

EUVD-2026-23340 MEDIUM

Cross-site Scripting (XSS) (CWE-79)

2026-04-17 Wordfence

XSS WordPress Elementor

6.4

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

6.4 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Apr 17, 2026 - 02:18 vuln.today

EUVD ID Assigned

Apr 17, 2026 - 02:15 euvd

EUVD-2026-23340

Analysis Generated

Apr 17, 2026 - 02:15 vuln.today

CVE Published

Apr 17, 2026 - 01:24 nvd

MEDIUM 6.4

DescriptionCVE.org

The Royal Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Instagram Feed widget's 'instagram_follow_text' setting in all versions up to, and including, 1.7.1056 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

AnalysisAI

Stored Cross-Site Scripting in Royal Addons for Elementor plugin versions up to 1.7.1056 allows authenticated attackers with Contributor-level access to inject arbitrary JavaScript via the Instagram Feed widget's 'instagram_follow_text' setting, executing malicious scripts whenever users view affected pages. The vulnerability stems from insufficient input sanitization and output escaping in the widget configuration handler. CVSS 6.4 reflects the moderate severity (network-accessible, no user interaction required from victims, but limited scope to stored XSS with low confidentiality and integrity impact). No public exploit code or active exploitation has been confirmed at time of analysis.

Technical ContextAI

The Royal Addons for Elementor plugin extends WordPress/Elementor with additional widgets for page building. The Instagram Feed widget accepts user-configurable text parameters including 'instagram_follow_text', which are stored in the WordPress post meta or Elementor element settings and rendered on the front-end without proper escaping. The vulnerability is a classic Stored XSS (CWE-79: Improper Neutralization of Input During Web Page Generation), where unsanitized user input is persisted in the database and later output in HTML context without escaping. The affected code references indicate multiple rendering paths in wpr-instagram-feed.php (lines 5334, 5528, 5623) where the setting is output, suggesting the sanitization gap exists across multiple display modes or template rendering functions. Elementor's widget infrastructure stores settings as JSON/serialized data in post meta, making stored XSS persistent across all page views and user sessions.

RemediationAI

Update Royal Addons for Elementor to the patched version released after 1.7.1056 (consult the WordPress plugin repository for the latest stable version, or monitor Wordfence advisory at https://www.wordfence.com/threat-intel/vulnerabilities/id/16d083bc-d726-4291-bc6d-a7bf83fa78c3 for the specific fix version). The plugin's changeset 3503219 in the reference indicates a patch has been applied to the repository; verify the version number and deploy via WordPress admin > Plugins > Updates. If immediate patching is not feasible, restrict Contributor-level role to trusted users only via WordPress user management, and audit existing Instagram Feed widgets for suspicious 'instagram_follow_text' content. Additionally, configure WordPress to limit Contributor role permissions by disabling direct post/page editing for untrusted accounts and enforcing Editor/Admin approval workflows. For defense-in-depth, deploy a WordPress security plugin (e.g., Wordfence, iThemes Security) with XSS filtering and stored content scanning, though this does not replace patching the root vulnerability. Monitor site for indicators of XSS injection by reviewing post revisions and widget settings for unusual JavaScript patterns or event handlers in 'instagram_follow_text' fields.