5.4
Medium
CVE-2026-19217 The Royal Addons for Elementor WordPress plugin before 1.7.1065 does not validate a widget setting used to build an…
Description
The Royal Addons for Elementor WordPress plugin before 1.7.1065 does not validate a widget setting used to build an HTML tag before outputting it, which could allow users with the Contributor role and above to perform Stored Cross-Site Scripting attacks.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| Royal Addons for Elementor 1.7 | earliest → < 1.7.1065 | 1.7.1065 |
Other CVEs of Royal Addons for Elementor
The 12 CVEs of Royal Addons for Elementor →
CVE-2026-107097
The Royal Addons for Elementor WordPress plugin before 1.7.1070 does not perform any authorization check before using…
5.3
Medium
CVE-2026-107098
The Royal Addons for Elementor WordPress plugin before 1.7.1070 does not sanitise and escape one of its map widget's…
6.8
Medium
CVE-2026-107100
The Royal Addons for Elementor WordPress plugin before 1.7.1070 does not verify that a requested post is publicly…
5.3
Medium
CVE-2026-106647
The Royal Addons for Elementor WordPress plugin before 1.7.1070 does not scope a contact form's email delivery…
3.8
Low