What is the CVSS score of EUVD-2026-30261?

EUVD-2026-30261 has a CVSS 3.1 base score of 6.4 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N. EPSS exploitation probability: 0.0%.

Royal Elementor Addons EUVD-2026-30261

| CVE-2026-6504 MEDIUM

Cross-site Scripting (XSS) (CWE-79)

2026-05-14 security@wordfence.com

GHSA-89fm-jw6x-x74w

XSS WordPress

6.4

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

6.4 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

May 14, 2026 - 09:30 vuln.today

CVE Published

May 14, 2026 - 09:16 nvd

MEDIUM 6.4

DescriptionCVE.org

The Royal Elementor Addons and Templates plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'title_tag' parameter in all versions up to, and including, 1.7.1058 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

AnalysisAI

Stored Cross-Site Scripting in Royal Elementor Addons and Templates plugin for WordPress up to version 1.7.1058 allows authenticated attackers with Contributor-level privileges to inject arbitrary JavaScript via the 'title_tag' parameter in multiple widgets, with execution occurring when any user accesses the affected page. The vulnerability stems from insufficient input sanitization and output escaping on user-controlled parameters.

Technical ContextAI

Royal Elementor Addons is a WordPress plugin that extends the Elementor page builder with additional widgets and templates. The vulnerability exists in two affected widget modules: wpr-posts-timeline.php and wpr-video-playlist.php, where the 'title_tag' parameter is processed without proper sanitization before being rendered in the DOM. The root cause is classified as CWE-79 (Improper Neutralization of Input During Web Page Generation - 'Cross-site Scripting'). The plugin fails to apply WordPress escaping functions (such as wp_kses_post() or esc_html()) when outputting the title_tag parameter, allowing malicious scripts injected by contributors to persist in the database and execute in the context of any user viewing the affected page.

RemediationAI

Update Royal Elementor Addons to the earliest patched version following 1.7.1058 (exact version not specified in provided data - check Wordfence advisory and plugin repository for current fix version). Immediately after patching, verify widget configuration in pages that previously used the Posts Timeline or Video Playlist widgets to ensure no malicious scripts are present. As a temporary workaround pending patch deployment, restrict Contributor-level access to trusted users only, or disable the wpr-posts-timeline and wpr-video-playlist widgets via the plugin's widget management settings until the patch is applied. For defense-in-depth, implement a Web Application Firewall rule to detect and block script tags in POST requests to the Elementor widgets API endpoint. Monitor the Wordfence threat advisory at https://www.wordfence.com/threat-intel/vulnerabilities/id/ed86e902-7637-481d-9005-7025187ba200 for patch confirmation and any active exploitation reports.