CVE-2026-107098: Royal Elementor Addons 1.7.1037 - 1.7.1069 - Contributor+ Stored XSS via Google Maps Widget Height Setting

Q: Who can exploit this issue?

A user with the WordPress Contributor role or any higher-privileged role can exploit it. The injected JavaScript executes when another user views the affected page, including an administrator reviewing a pending submission.

Q: Which installations are affected?

WP Royal Royal Addons for Elementor versions before 1.7.1070 are affected. The vulnerable input is a size setting in the plugin's Google Maps widget.

Q: What is the immediate mitigation if updating is not possible?

Do not allow Contributor-level or higher untrusted users to create or edit content using the Google Maps widget's affected size setting. Review pending submissions and existing pages that use this widget before viewing them in an administrator browser.

Published Oct 28, 2026

Updated

The Royal Addons for Elementor WordPress plugin before 1.7.1070 does not sanitise and escape one of its map widget's size settings before concatenating it into an HTML attribute, allowing users with the Contributor role or above to inject JavaScript that runs in the browser of any user who views the page, including an administrator reviewing a pending submission.

Affected Software

1 affected component

WP Royal Royal Addons for Elementor<1.7.1070

Event History

Oct 28, 2026

CVE Published

via MITRE·06:00 AM

Data Sourced

via MITRE·06:00 AM

DescriptionWeakness

Frequently Asked Questions

Who can exploit this issue?

A user with the WordPress Contributor role or any higher-privileged role can exploit it. The injected JavaScript executes when another user views the affected page, including an administrator reviewing a pending submission.

Which installations are affected?

WP Royal Royal Addons for Elementor versions before 1.7.1070 are affected. The vulnerable input is a size setting in the plugin's Google Maps widget.

What is the immediate mitigation if updating is not possible?

Do not allow Contributor-level or higher untrusted users to create or edit content using the Google Maps widget's affected size setting. Review pending submissions and existing pages that use this widget before viewing them in an administrator browser.

CVE-2026-107098: Royal Elementor Addons 1.7.1037 - 1.7.1069 - Contributor+ Stored XSS via Google Maps Widget Height Setting

Affected Software

Event History

Frequently Asked Questions

Who can exploit this issue?

Which installations are affected?

What is the immediate mitigation if updating is not possible?

Company

Resources

Contact

Frequently Asked Questions

Who can exploit this issue?

Which installations are affected?

What is the immediate mitigation if updating is not possible?