Description

The Royal Addons for Elementor WordPress plugin before 1.7.1066 does not validate some widget settings before outputting them inside an HTML attribute, which could allow users with the Contributor role and above to perform Stored Cross-Site Scripting attacks.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.8",
  "pubDate": "2026-08-26T06:16:25.803Z",
  "pubdate": "2026-08-26T06:16:25.803Z",
  "executiveSummary": "The Royal Addons for Elementor WordPress plugin is susceptible to a Stored Cross-Site Scripting (XSS) vulnerability due to insufficient input validation.\nThis vulnerability allows authenticated users with at least Contributor-level privileges to inject malicious JavaScript payloads into widget settings.\nWhen rendered, these payloads are executed within the context of other users' browsers, including those with administrative privileges.\nThe flaw stems from the failure to sanitize or escape user-supplied widget configuration data before embedding it into HTML attributes.\nSuccessful exploitation poses significant security risks, including session hijacking, unauthorized administrative actions, and the potential for full site compromise.\nThe issue affects all versions of the Royal Addons for Elementor plugin prior to 1.7.1066.\nNo external network exposure is required for the initial exploit as it relies on an authenticated session; however, the impact persists across the application domain once the malicious content is stored and subsequently rendered.",
  "technicalDetails": "The vulnerability is classified as Stored Cross-Site Scripting (XSS), originating from the insecure handling of widget configuration settings within the Royal Addons for Elementor plugin.\nThe root cause is a lack of server-side input validation and output encoding during the processing of widget parameters. Specifically, the plugin permits the submission of arbitrary data through widget configuration fields without subjecting this data to adequate sanitization filters.\nWhen these parameters are processed, the plugin fails to utilize appropriate output encoding functions (such as esc_attr() or esc_html() in the WordPress context) before rendering the data inside HTML attributes. This allows an attacker to break out of the intended attribute context by injecting event handlers (e.g., 'onmouseover', 'onerror') or closing the attribute tags to execute arbitrary JavaScript.\nExploitation follows a specific workflow: 1) An attacker with Contributor privileges logs into the WordPress environment. 2) The attacker accesses the Elementor editor and inserts a vulnerable Royal Addons widget. 3) The attacker modifies the widget settings, injecting a crafted XSS payload into fields that lack validation. 4) The settings are saved to the WordPress database. 5) When an administrator or another user views a page containing the compromised widget, the browser renders the malicious script contained within the attribute.\nBecause the payload is stored persistently in the database, the execution occurs automatically whenever the affected component is loaded in the Document Object Model (DOM). This creates a 'stored' attack vector that does not require further interaction from the attacker after the initial injection.\nThe impact of the payload execution is constrained only by the privileges of the victim. If an administrator views the page, the JavaScript can be used to perform unauthorized actions such as creating new administrative users, installing malicious plugins, or redirecting site traffic, effectively leading to a total compromise of the WordPress installation.\nAffected versions are identified as all releases prior to 1.7.1066. The vulnerability requires a minimum of Contributor-level access to the Elementor interface to successfully inject the payload into the plugin's configuration data structures."
}