CVE-2026-19217

Deferred Deferred - Pending Action

Stored XSS in Royal Addons for Elementor WordPress Plugin

Publication date: 2026-08-12

Last updated on: 2026-08-26

Assigner: WPScan

Description

The Royal Addons for Elementor WordPress plugin before 1.7.1065 does not validate a widget setting used to build an HTML tag before outputting it, which could allow users with the Contributor role and above to perform Stored Cross-Site Scripting attacks.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-12

Last Modified

2026-08-26

Generated

2026-09-01

AI Q&A

2026-08-12

EPSS Evaluated

2026-08-31

NVD

CVE-2026-19217

EUVD

EUVD-2026-57108

Affected Vendors & Products

Vendor	Product	Version / Range
royal_addons	royal_elementor_addons	to 1.7.1065 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-79	The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Attack-Flow Graph

Executive Summary

The Royal Addons for Elementor WordPress plugin before version 1.7.1065 has a flaw where it does not properly validate widget settings used to construct HTML tags. This allows users with Contributor role or higher to inject malicious scripts through Stored Cross-Site Scripting (XSS) attacks.

Detection Guidance

To detect this vulnerability, check the installed version of the Royal Addons for Elementor plugin. If it is below 1.7.1065, the system is vulnerable. Inspect widget settings for the Icon Box Widget to identify improperly validated HTML tag inputs.

Impact Analysis

Attackers with Contributor access or higher could inject scripts that execute when other users view affected pages. This could lead to theft of session cookies, account takeover, or defacement of the website. The impact depends on user privileges and site configuration.

Compliance Impact

This vulnerability could lead to unauthorized access or data breaches, potentially violating GDPR (data protection) or HIPAA (health information privacy) if sensitive user data is exposed. Compliance may be impacted if the site fails to protect user data adequately.

Mitigation Strategies

Immediately update the Royal Addons for Elementor plugin to version 1.7.1065 or later. Restrict user roles to the minimum required permissions, especially for Contributor roles, to reduce attack surface.

Hi! I’m here to help you understand CVE-2026-19217. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70