Royal Elementor Addons < 1.7.1057 - Contributor+ Stored Cross-Site Scripting via 'Follow Button Text' Parameter

Description

The plugin is vulnerable to Stored Cross-Site Scripting via the Instagram Feed widget's `instagram_follow_text` setting due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers with Contributor-level access and above to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Exploitation requires that an administrator has previously configured the Instagram Feed widget with a valid Instagram access token.