CVE-2026-5162
Stored XSS in Royal Addons Elementor Instagram Feed Widget
Publication date: 2026-04-17
Last updated on: 2026-04-17
Assigner: Wordfence
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| royal_addons | elementor_plugin | to 1.7.1056 (inc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-79 | The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
The Royal Addons for Elementor plugin for WordPress has a Stored Cross-Site Scripting (XSS) vulnerability in its Instagram Feed widget's 'instagram_follow_text' setting. This vulnerability exists in all versions up to and including 1.7.1056. It is caused by insufficient input sanitization and output escaping, which allows authenticated users with Contributor-level access or higher to inject arbitrary web scripts into pages.
These injected scripts execute whenever any user accesses the affected page, potentially compromising the security of the website and its visitors.
How can this vulnerability impact me? :
This vulnerability can allow attackers with Contributor-level access or higher to inject malicious scripts into web pages. These scripts execute in the context of users visiting those pages, potentially leading to theft of sensitive information, session hijacking, defacement, or distribution of malware.
Because the vulnerability is a Stored Cross-Site Scripting issue, the malicious code persists on the site and affects all users who view the compromised pages.
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
The vulnerability allows authenticated attackers with Contributor-level access and above to inject arbitrary web scripts via Stored Cross-Site Scripting (XSS) in the Royal Addons for Elementor plugin. This can lead to unauthorized access to user data or manipulation of web content.
Such vulnerabilities can impact compliance with standards like GDPR and HIPAA because they may lead to unauthorized disclosure or alteration of personal or sensitive information, violating data protection and privacy requirements.
However, specific impacts on compliance depend on the context of data handled and the presence of mitigating controls.