WordPress Plugin Vulnerabilities

Royal Elementor Addons < 1.7.1065 - Contributor+ Stored XSS via Icon Box Widget

Description

The plugin does not validate a widget setting used to build an HTML tag before outputting it, which could allow users with the Contributor role and above to perform Stored Cross-Site Scripting attacks.

Proof of Concept

Affects Plugins

Plugin icon
royal-elementor-addons
Fixed in 1.7.1065

References

CVE
CVE-2026-19217

Classification

Type
XSS
OWASP top 10
A7: Cross-Site Scripting (XSS)
CWE
CWE-79
CVSS
6.8 (medium)

Miscellaneous

Original Researcher
Dmitrii Ignatyev
Submitter
Dmitrii Ignatyev
Submitter website
https://research.cleantalk.org/
Verified
Yes
WPVDB ID
c27c1dcd-a6d2-4e1d-a9da-88dff8fe5618

Timeline

Publicly Published
2026-08-10 (about 2 days ago)
Added
2026-08-10 (about 1 day ago)
Last Updated
2026-08-10 (about 1 day ago)

Other

Published
Title
Published
2025-01-23
Title
Paid Membership Plugin < 4.15.20 - Admin+ Stored XSS
Published
2025-11-04
Title
Spectra < 2.19.15 - Contributor+ Stored XSS via Custom CSS
Published
2026-02-10
Title
Business Template Blocks for WPBakery (Visual Composer) Page Builder <= 1.3.2 - Reflected Cross-Site Scripting
Published
2024-09-24
Title
Medical Addon for Elementor <= 1.6.4 - Contributor+ Stored XSS
Published
2026-07-23
Title
Machete <= 5.2 - Authenticated (Author+) Stored Cross-Site Scripting