Description

The Royal Addons for Elementor WordPress plugin before 1.7.1065 does not validate a widget setting used to build an HTML tag before outputting it, which could allow users with the Contributor role and above to perform Stored Cross-Site Scripting attacks.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "5.4",
  "pubDate": "2026-08-12T06:21:47.283Z",
  "pubdate": "2026-08-12T06:21:47.283Z",
  "executiveSummary": "An input validation vulnerability exists within the Royal Addons for Elementor WordPress plugin affecting versions prior to 1.7.1065. The flaw is classified as a Stored Cross-Site Scripting (XSS) vulnerability, enabling authenticated threat actors with restricted privileges to inject arbitrary malicious scripts into stored application data. When rendered by the browser, these scripts execute within the context of other users' sessions, potentially leading to administrative session hijacking, unauthorized administrative actions, and further compromise of the underlying WordPress installation. Exploitation of this vulnerability requires authenticated access with the Contributor role or higher, meaning an attacker must first obtain valid credentials and access to the WordPress post editor interface. The root cause stems from the application failing to properly sanitize or validate user-supplied widget settings before incorporating them into dynamically constructed HTML tags and rendering them in the Document Object Model (DOM). Risk implications include the degradation of application integrity and potential compromise of high-privilege user sessions interacting with pages containing the affected widgets.",
  "technicalDetails": "The vulnerability resides in the Royal Addons for Elementor WordPress plugin, specifically affecting software iterations prior to version 1.7.1065. The underlying architectural flaw is characterized by insufficient input sanitization and improper output encoding of user-controlled parameters. Specifically, the component responsible for processing a specific widget setting fails to validate or sanitize values utilized in the programmatic construction of HTML tags prior to rendering the output to the client browser.\nThe attack vector involves an authenticated user possessing the Contributor role—or any higher-privileged role with permissions to edit pages and utilize Elementor widgets—manipulating the vulnerable widget configuration parameters. During the creation or modification of a post or page using the Elementor page builder interface, the attacker supplies a crafted payload containing malicious JavaScript within the unvalidated widget setting.\nStep-by-step attack flow begins with the attacker authenticating to the WordPress dashboard with Contributor-level privileges. The attacker navigates to the post or page editor, adds or edits the vulnerable Royal Addons widget, and injects the malicious payload into the vulnerable setting field. Upon saving the post or page layout, the malicious payload is committed and stored within the WordPress database without undergoing rigorous validation or structural sanitization.\nWhen a victim, such as a high-privileged administrator or an unsuspecting visitor, navigates to the rendered page containing the modified widget, the server retrieves the malicious string from the database and embeds it directly into the generated HTML markup without appropriate contextual output encoding. The browser parses the resulting HTML tag, interprets the injected payload as executable script code, and executes the arbitrary JavaScript in the victim's browser session.\nThe post-exploitation impact depends on the privileges of the user viewing the compromised page. If a privileged user or administrator views the page, the executing script can perform actions on their behalf, such as creating new administrative accounts, modifying plugin configurations, or injecting additional persistence mechanisms into the WordPress environment. The vulnerability is entirely browser-based once stored and relies on client-side script execution within the Document Object Model."
}