Royal Elementor Addons EUVD-2026-25400

| CVE-2026-5428 MEDIUM

Cross-site Scripting (XSS) (CWE-79)

2026-04-24 Wordfence

GHSA-f4r3-xfjm-5x8p

WordPress XSS

6.4

CVSS 3.1

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Apr 24, 2026 - 06:30 vuln.today

DescriptionNVD

The Royal Elementor Addons plugin for WordPress is vulnerable to Stored Cross-Site Scripting via image captions in the Image Grid/Slider/Carousel widget in versions up to and including 1.7.1056. This is due to insufficient output escaping in the render_post_thumbnail() function, where wp_kses_post() is used instead of esc_attr() for the alt attribute context. This makes it possible for authenticated attackers, with Author-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses a page with the malicious image displayed in the media grid widget.

AnalysisAI

Stored cross-site scripting in Royal Elementor Addons plugin for WordPress up to version 1.7.1056 allows authenticated attackers with Author-level access to inject arbitrary JavaScript via image alt attributes in the Image Grid/Slider/Carousel widget. The vulnerability results from insufficient output escaping in the render_post_thumbnail() function, where wp_kses_post() is used instead of esc_attr() for HTML attribute context. …

Analysis

Detailed AI-generated intelligence summary covering attack vector, impact assessment, affected versions, remediation steps, and indicators of compromise.

POChttps://••••••••••.com/exploit

PATCHhttps://••••••••••.com/patch

ADVISORYhttps://••••••••••.com/advisory

Full analysis requires sign-in

Get intelligence summaries, risk assessment, exploit details, threat intel, and remediation guidance.

EUVD-2026-25400 vulnerability details – vuln.today

Back