CVE-2026-119518: WordPress Royal Elementor Addons plugin <= 1.7.1070 - Cross Site Scripting (XSS) vulnerability
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WProyal Royal Elementor Addons royal-elementor-addons allows Stored XSS.This issue affects Royal Elementor Addons: from n/a through 1.7.1070.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
wordpress/royal-elementor-addonsto a version that resolves this vulnerability.Fixed in 1.7.1071
Event History
Frequently Asked Questions
Which installations are affected?
Royal Elementor Addons versions through 1.7.1070 are affected. The available information does not state whether any particular configuration or feature must be enabled.
What level of access does an attacker need?
The CVSS vector indicates that an attacker needs low-level privileges and user interaction. The vulnerability is remotely reachable with low attack complexity.
What is the potential impact of successful exploitation?
This is a stored XSS issue, meaning attacker-supplied script can be retained and later executed when a user views affected content. The supplied severity vector indicates low confidentiality, integrity, and availability impact, with scope changed.