WordPress Plugin Vulnerabilities

Royal Elementor Addons < 1.7.1066 - Contributor+ Stored XSS via Image Accordion Widget Effect Settings

Description

The plugin does not validate some widget settings before outputting them inside an HTML attribute, which could allow users with the Contributor role and above to perform Stored Cross-Site Scripting attacks.

Proof of Concept

Affects Plugins

Plugin icon
royal-elementor-addons
Fixed in 1.7.1066

References

CVE
CVE-2026-19226

Classification

Type
XSS
OWASP top 10
A7: Cross-Site Scripting (XSS)
CWE
CWE-79
CVSS
6.8 (medium)

Miscellaneous

Original Researcher
Erwan LR (WPScan)
Submitter
Erwan LR (WPScan)
Verified
Yes
WPVDB ID
1454d76e-c90b-40b3-b0b8-fb9a25ffb183

Timeline

Publicly Published
2026-08-24 (about 3 days ago)
Added
2026-08-24 (about 2 days ago)
Last Updated
2026-08-24 (about 2 days ago)

Other

Published
Title
Published
2026-05-27
Title
Login No Captcha reCAPTCHA < 1.8.1 - Unauthenticated Stored Cross-Site Scripting via PHP_SELF
Published
2024-06-06
Title
Kognetiks Chatbot for WordPress < 1.9.9 - Authenticated (Contributor+) Stored Cross-Site Scripting
Published
2017-08-24
Title
BackupGuard < 1.1.47 - Authenticated Cross-Site Scripting (XSS)
Published
2026-01-06
Title
My Album Gallery <= 1.0.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'style_css' Shortcode Attribute
Published
2015-08-25
Title
Post video players <= 1.136 - Authenticated Stored Cross-Site Scripting (XSS)