WordPress Plugin Vulnerabilities

Royal Addons for Elementor < 1.7.1057 - Contributor+ Stored XSS via Instagram Feed Widget

Description

The plugin is vulnerable to Stored Cross-Site Scripting via the Instagram Feed widget's 'instagram_follow_text' setting due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

Affects Plugins

Plugin icon
royal-elementor-addons
Fixed in 1.7.1057

References

CVE
CVE-2026-5162
URL
https://www.wordfence.com/threat-intel/vulnerabilities/id/16d083bc-d726-4291-bc6d-a7bf83fa78c3

Classification

Type
XSS
OWASP top 10
A7: Cross-Site Scripting (XSS)
CWE
CWE-79
CVSS
5.9 (medium)

Miscellaneous

Original Researcher
Caspian
Verified
No
WPVDB ID
3e8bd1af-27b9-49f8-a0dd-aa02d8309859

Timeline

Publicly Published
2026-04-16 (about 27 days ago)
Added
2026-04-16 (about 27 days ago)
Last Updated
2026-04-16 (about 27 days ago)

Other

Published
Title
Published
2021-08-06
Title
Pods < 2.7.29 - Multiple Authenticated Stored Cross-Site Scripting (XSS)
Published
2024-06-18
Title
Slideshow SE <= 2.5.20 - Authenticated (Author+) Stored Cross-Site Scripting
Published
2024-08-07
Title
Organization chart < 1.5.1 - Authenticated (Subscriber+) Stored Cross-Site Scripting via title_input and node_description Parameters
Published
2024-10-14
Title
Crazy Call To Action Box <= 1.05 - Authenticated (Contributor+) Stored Cross-Site Scripting
Published
2024-10-28
Title
SW Kick Integration - Blocks and Shortcodes for Embedding Kick Streams < 1.1.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via sw-kick-embed Shortcode