Executive brief
Royal Addons for Elementor is a WordPress plugin that extends the Elementor page builder with additional widgets. The plugin fails to validate user input on the "Title HTML Tag" setting in the Icon Box widget, allowing contributors and higher-privileged users to inject malicious JavaScript that executes when the page is viewed by administrators, editors, or other visitors. This can lead to account compromise, data theft, or malware distribution.
Technical details
The vulnerability is a Stored Cross-Site Scripting (XSS) flaw in the Royal Addons for Elementor plugin, specifically in the Icon Box widget. The widget's "Title HTML Tag" setting is not validated server-side before being output into HTML, despite being a dropdown control in the UI. An authenticated attacker with Contributor role or above can craft a malicious request to the Elementor editor's save endpoint, injecting arbitrary HTML/JavaScript (e.g., `img src=x onerror=alert(document.domain) data-x=`) into this field. When the page is previewed or published, the unsanitized value is rendered directly as an HTML tag, executing the injected script in the browser of any visitor or administrator. The vulnerability affects versions before 1.7.1065 and is fixed in that version.
Affected products
- Royal Themes Royal Addons for Elementor before 1.7.1065
Timeline
- 2026-08-10: disclosed
- 2026-08-12: advisory
- 2026-08-12: patched: Fixed in version 1.7.1065