CVE-2026-19226: Royal Elementor Addons < 1.7.1066 - Contributor+ Stored XSS via Image Accordion Widget Effect Settings

Q: Which users could exploit this issue?

A user with the Contributor role or any higher-privileged role could exploit the affected widget settings. The available data does not indicate that unauthenticated users or Subscribers can exploit it.

Q: What configuration or feature must be in use for exposure?

The issue is associated with the Image Accordion widget's effect settings in Royal Addons for Elementor. The provided information does not establish whether those settings are enabled or exposed by default.

Q: How can I determine whether my site is affected?

Check whether Royal Addons for Elementor is installed and running a version earlier than 1.7.1066. Also review whether Contributor-or-higher accounts can create or modify Image Accordion widgets and their effect settings.

Published Aug 26, 2026

Updated

The Royal Addons for Elementor WordPress plugin before 1.7.1066 does not validate some widget settings before outputting them inside an HTML attribute, which could allow users with the Contributor role and above to perform Stored Cross-Site Scripting attacks.

Affected Software

1 affected component

WordPress plugin: Royal Addons for Elementor<1.7.1066

Event History

Aug 26, 2026

CVE Published

via MITRE·06:00 AM

Data Sourced

via MITRE·06:00 AM

DescriptionWeakness

Frequently Asked Questions

Which users could exploit this issue?

A user with the Contributor role or any higher-privileged role could exploit the affected widget settings. The available data does not indicate that unauthenticated users or Subscribers can exploit it.

What configuration or feature must be in use for exposure?

The issue is associated with the Image Accordion widget's effect settings in Royal Addons for Elementor. The provided information does not establish whether those settings are enabled or exposed by default.

How can I determine whether my site is affected?

Check whether Royal Addons for Elementor is installed and running a version earlier than 1.7.1066. Also review whether Contributor-or-higher accounts can create or modify Image Accordion widgets and their effect settings.