CVE-2026-19226
Received Received - Intake

Stored XSS in Royal Addons for Elementor WordPress Plugin

Publication date: 2026-08-26

Last updated on: 2026-08-26

Assigner: WPScan

Description
The Royal Addons for Elementor WordPress plugin before 1.7.1066 does not validate some widget settings before outputting them inside an HTML attribute, which could allow users with the Contributor role and above to perform Stored Cross-Site Scripting attacks.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-26
Last Modified
2026-08-26
Generated
2026-08-26
AI Q&A
2026-08-26
EPSS Evaluated
N/A
NVD
CVE-2026-19226
EUVD
EUVD-2026-66275

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
royal_addons elementor to 1.7.1066 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-79 The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is a Stored Cross-Site Scripting (XSS) issue in the Royal Addons for Elementor WordPress plugin before version 1.7.1066. It occurs because the plugin does not properly validate widget settings before outputting them in HTML attributes. This allows users with Contributor role or higher to inject malicious scripts that are stored and executed when other users view the affected pages.

Detection Guidance

Check if the Royal Addons for Elementor plugin version is below 1.7.1066. Inspect widget settings for unsanitized user input in HTML attributes. Review stored data for malicious scripts.

Impact Analysis

An attacker could exploit this to steal sensitive user data, such as cookies or session tokens, by tricking users into visiting a page with the injected script. It may also allow the attacker to perform actions on behalf of users, modify page content, or redirect users to malicious websites.

Compliance Impact

This vulnerability could lead to data breaches, which may violate GDPR if personal data is exposed, or HIPAA if protected health information is compromised. Organizations could face fines, legal penalties, and reputational damage due to non-compliance with these regulations.

Mitigation Strategies

Update the Royal Addons for Elementor plugin to version 1.7.1066 or later. Restrict Contributor role permissions to reduce attack surface. Monitor for unusual script activity in stored content.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-19226. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart