CVE-2026-19226
Royal Elementor Addons < 1.7.1066 - Contributor+ Stored XSS via Image Accordion Widget Effect Settings
CVSS Score
6.8
EPSS Score
0.2%
EPSS Percentile
8th
The Royal Addons for Elementor WordPress plugin before 1.7.1066 does not validate some widget settings before outputting them inside an HTML attribute, which could allow users with the Contributor role and above to perform Stored Cross-Site Scripting attacks.
| Vendor | unknown |
| Product | royal addons for elementor |
| Published | Aug 26, 2026 |
| Last Updated | Aug 26, 2026 |
Stay Ahead of the Next One
Get instant alerts for unknown royal addons for elementor
Be the first to know when new medium vulnerabilities affecting unknown royal addons for elementor are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
Affected Versions
Unknown / Royal Addons for Elementor
0 < 1.7.1066
References
Credits
Erwan LR (WPScan) WPScan