Royal Elementor Addons < 1.7.1057 - Unauthenticated Stored Cross-Site Scripting via 'status' Parameter

Description

The plugin is vulnerable to Stored Cross-Site Scripting via the `status` parameter in the `wpr_update_form_action_meta` AJAX action due to insufficient input sanitization and output escaping, combined with a publicly leaked nonce that allows unauthenticated access to the handler. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.