Executive brief
Royal Addons for Elementor is a WordPress plugin that provides custom widgets for the Elementor page builder. The plugin fails to properly validate widget settings before inserting them into HTML attributes, allowing contributors and higher-privileged users to inject malicious scripts. When administrators or visitors view content containing the malicious widget, the injected script executes in their browsers, potentially compromising their accounts or stealing sensitive information.
Technical details
The Royal Addons for Elementor plugin contains a Stored Cross-Site Scripting (XSS) vulnerability in the Image Accordion widget's effect settings (Image Effects, Image Effects Size, and Overlay Animation). The vulnerability arises because user-supplied values from these dropdown controls are not validated server-side before being output directly into HTML attributes. An attacker with Contributor role or above can craft a POST request with a malicious payload (e.g., 'none" onmouseover="alert(/XSS/)') that bypasses Elementor's tag-based sanitization. When the post is published or previewed, the injected event handler executes in the browsers of editors, administrators, or any site visitor. The vulnerability affects versions before 1.7.1066 and is fixed in version 1.7.1066.
Affected products
- Royal Elementor Addons Royal Addons for Elementor before 1.7.1066
Timeline
- 2026-08-24: disclosed
- 2026-08-26: advisory
- 2026-08-26: patched: Fixed in version 1.7.1066