CVE-2026-97254: WordPress Royal Elementor Addons plugin <= 1.7.1069 - Cross Site Scripting (XSS) vulnerability

Q: What level of access does an attacker need to exploit this issue?

The attack vector requires network access, low privileges, and user interaction. An attacker must be able to submit crafted input and a user must later view the affected content for the stored XSS payload to execute.

Q: What is the potential impact if exploitation succeeds?

The vulnerability is rated medium severity with a CVSS score of 6.5. It can affect confidentiality, integrity, and availability at low impact, with scope changed.

Q: Which versions are affected?

Royal Elementor Addons versions through 1.7.1069 are affected. The available data does not identify a fixed version.

Published Oct 26, 2026

Updated

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WProyal Royal Elementor Addons royal-elementor-addons allows Stored XSS.This issue affects Royal Elementor Addons: from n/a through 1.7.1069.

Affected Software

1 affected component

WProyal Royal Elementor Addons<=1.7.1069

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade wordpress/royal-elementor-addons to a version that resolves this vulnerability.
Fixed in 1.7.1070

Event History

Oct 26, 2026

CVE Published

via MITRE·10:02 AM

Data Sourced

via MITRE·10:02 AM

RemedyDescriptionSeverityWeakness

Frequently Asked Questions

What level of access does an attacker need to exploit this issue?

The attack vector requires network access, low privileges, and user interaction. An attacker must be able to submit crafted input and a user must later view the affected content for the stored XSS payload to execute.

What is the potential impact if exploitation succeeds?