CVE-2026-13407: Royal Elementor Addons < 1.7.1067 - Unauthenticated Stored HTML Injection in Form Notification Emails
The Royal Elementor Addons WordPress plugin before 1.7.1067 does not properly sanitize and escape values submitted through its form widget before including them in the body of administrator notification emails, allowing unauthenticated attackers to inject arbitrary HTML into emails sent to the site administrator on form submission.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
An unauthenticated attacker can exploit it by submitting crafted values through the plugin's form widget. No existing WordPress account or elevated privileges are required.
What conditions are required for exploitation?
The affected site must use a Royal Elementor Addons version earlier than 1.7.1067 and have a form widget that an attacker can submit. Exploitation also relies on an administrator notification email being generated for that submission.
What is the impact of a successful attack?
An attacker can inject arbitrary HTML into the body of notification emails sent to the site administrator. The reported impact is limited to low confidentiality and low integrity effects, with no availability impact.
How can I determine whether my site is affected?
Check the installed Royal Elementor Addons plugin version. Versions earlier than 1.7.1067 are affected; review form-submission notification emails for unexpected HTML if the plugin was previously running an affected version.