EUVD-2026-80217
GHSA-qfg2-4qwg-49vh
Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N
Unauthenticated remote form submission (PR:N, AV:N, AC:L) but impact requires the admin to open the injected email (UI:R), yielding only low C/I and no availability loss.
Primary rating from Vendor (WPScan).
CVSS VectorVendor: WPScan
Lifecycle Timeline
5DescriptionCVE.org
The Royal Elementor Addons WordPress plugin before 1.7.1067 does not properly sanitize and escape values submitted through its form widget before including them in the body of administrator notification emails, allowing unauthenticated attackers to inject arbitrary HTML into emails sent to the site administrator on form submission.
AnalysisAI
HTML injection in the Royal Elementor Addons WordPress plugin before version 1.7.1067 lets unauthenticated visitors inject arbitrary HTML into the administrator notification emails generated by the plugin's form widget. Because form submissions are not sanitized before being embedded in the email body, an attacker can place crafted markup, malicious links, or spoofed content in mail that lands in the site administrator's inbox. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | The site must be running Royal Elementor Addons before 1.7.1067 AND the plugin's form widget must be placed on a publicly reachable page so that unauthenticated visitors can submit entries (CVSS PR:N, AV:N). … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N) describes a low-complexity, network-reachable injection that requires no authentication or privileges on the attacker side but depends on the administrator opening the notification email (UI:R). … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Update Royal Elementor Addons to version 1.7.1067 or later - this is the fixed release identified by the reporting source - and confirm the plugin version through the WordPress admin or WP-CLI (`wp plugin list`). … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Royal Addons For Elementor
View allStored Cross-Site Scripting in the Royal Addons for Elementor WordPress plugin (all versions before 1.7.1065) allows aut
Stored Cross-Site Scripting in the Royal Addons for Elementor WordPress plugin (all versions before 1.7.1066) permits an
Arbitrary PHP code execution in Royal Addons for Elementor WordPress plugin (all versions before 1.7.1066) is reachable
Unauthenticated information disclosure in Royal Addons for Elementor (WordPress plugin) before version 1.7.1066 exposes
Unauthenticated metadata tampering in Royal Addons for Elementor WordPress plugin before 1.7.1066 allows any remote visi
Royal Addons for Elementor WordPress plugin before 1.7.1063 exposes private and draft Elementor template content to unau
Share
External POC / Exploit Code
Leaving vuln.today