Is CVE-2026-19226 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-19226 being exploited in the wild.

How severe is CVE-2026-19226?

Medium severity, with a CVSS score of 6.8, published 26 August 2026.

Which products and versions are affected?

Royal Elementor Addons Royal Addons for Elementor before 1.7.1066.

Is there a fix for CVE-2026-19226?

A patch was published on 2026-08-26: Fixed in version 1.7.1066 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-19226 attacked?

It is attacked over the network.

Am I affected by CVE-2026-19226?

Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-19226: Royal Addons for Elementor stored XSS in Image Accordion widget

CVE-2026-19226 · Severity: medium · CVSS 6.8 · Published 2026-08-26

Royal Addons for Elementor is a WordPress plugin that provides custom widgets for the Elementor page builder. The plugin fails to properly validate widget settings before inserting them into HTML attributes, allowing contributors and higher-privileged users to inject malicious scripts. When administrators or visitors view content containing the malicious widget, the injected script executes in their browsers, potentially compromising their accounts or stealing sensitive information.

Quick answers

Is CVE-2026-19226 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-19226 being exploited in the wild.
How severe is CVE-2026-19226?: Medium severity, with a CVSS score of 6.8, published 26 August 2026.
Which products and versions are affected?: Royal Elementor Addons Royal Addons for Elementor before 1.7.1066.
Is there a fix for CVE-2026-19226?: A patch was published on 2026-08-26: Fixed in version 1.7.1066 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-19226 attacked?: It is attacked over the network.
Am I affected by CVE-2026-19226?: Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The Royal Addons for Elementor plugin contains a Stored Cross-Site Scripting (XSS) vulnerability in the Image Accordion widget's effect settings (Image Effects, Image Effects Size, and Overlay Animation). The vulnerability arises because user-supplied values from these dropdown controls are not validated server-side before being output directly into HTML attributes. An attacker with Contributor role or above can craft a POST request with a malicious payload (e.g., 'none" onmouseover="alert(/XSS/)') that bypasses Elementor's tag-based sanitization. When the post is published or previewed, the injected event handler executes in the browsers of editors, administrators, or any site visitor. The vulnerability affects versions before 1.7.1066 and is fixed in version 1.7.1066.

Affected products

Royal Elementor Addons Royal Addons for Elementor before 1.7.1066

Timeline

2026-08-24: disclosed
2026-08-26: advisory
2026-08-26: patched: Fixed in version 1.7.1066

References

https://wpscan.com/vulnerability/1454d76e-c90b-40b3-b0b8-fb9a25ffb183/

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.