Royal Elementor Addons CVE-2026-97254

Exploitation requires an authenticated account with at least low-level privileges (PR:L - typically a contributor/author-tier WordPress user able to submit content through the plugin) to store the malicious payload, and requires a second user (UI:R - e.g., an administrator or site visitor) to subsequently view the page where the payload renders, at which point script executes in their browser context (S:C). The exact plugin feature, field, or parameter that fails to neutralize input is not described in the available sources. Limiting factors: the attacker cannot act fully unauthenticated, cannot trigger execution without a victim viewing the content, and impact is bounded to the victim's browser session rather than direct server compromise.

This is a moderate-severity stored XSS (CVSS 6.5, CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L) in the Royal Elementor Addons WordPress plugin, reported by Patchstack and assigned the vuln.today priority 'this_month' - a scheduled-remediation signal, not an emergency. The CVSS vector points to network-reachable but authenticated exploitation (PR:L) that additionally depends on victim interaction (UI:R), with a scope change (S:C) reflecting that injected script executes in a different security context (the browser of whoever views the page). No EPSS score, no CISA KEV listing, and no verified exploit code are present in the supplied data, so there is no public exploit identified at time of analysis and no evidence of active exploitation. The combination of required authentication, required user interaction, and low individual confidentiality/integrity/availability impacts keeps real-world risk in the moderate band rather than critical, despite the network attack vector. The main caveat: the input does not state a fixed version (only 'affects from n/a through 1.7.1069'), so the remediation target is unconfirmed from the provided data and should be verified against the Patchstack advisory or vendor changelog.

An attacker with a low-privileged authenticated account (e.g., a contributor or author role) uses the plugin to store a malicious script payload in content that is later rendered to other users. When an administrator or other visitor views the affected page, the stored script executes in their browser session, enabling session/cookie theft or actions performed in the victim's context. No public exploit code is identified in the provided sources, and the specific injectable field is not described.