6.4 Moyenne

CVE-2026-5428 The Royal Elementor Addons plugin for WordPress is vulnerable to Stored Cross-Site Scripting via image captions in the…

Description

The Royal Elementor Addons plugin for WordPress is vulnerable to Stored Cross-Site Scripting via image captions in the Image Grid/Slider/Carousel widget in versions up to and including 1.7.1056. This is due to insufficient output escaping in the render_post_thumbnail() function, where wp_kses_post() is used instead of esc_attr() for the alt attribute context. This makes it possible for authenticated attackers, with Author-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses a page with the malicious image displayed in the media grid widget.

Produits et versions touchés

Produit	Versions touchées	Corrigé en
Royal Addons for Elementor – Addons and Templates Kit for Elementor 1.7	premières → 1.7.1056	Pas de correctif indiqué

Références

www.wordfence.com www.wordfence.com
plugins.trac.wordpress.org plugins.trac.wordpress.org
plugins.trac.wordpress.org plugins.trac.wordpress.org
plugins.trac.wordpress.org plugins.trac.wordpress.org
plugins.trac.wordpress.org plugins.trac.wordpress.org
plugins.trac.wordpress.org plugins.trac.wordpress.org
research.cleantalk.org research.cleantalk.org

Chronologie

Publiée 24 avril 2026
Dernière modification 14 août 2026

Les 60 CVE de Royal Addons for Elementor – Addons and Templates Kit for Elementor →

CVE-2026-17585 The Royal Addons for Elementor – Addons and Templates Kit for Elementor plugin for WordPress is vulnerable to… 5.3 Moyenne CVE-2026-17123 The Royal Elementor Addons plugin for WordPress is vulnerable to Server-Side Request Forgery in versions up to, and… 8.8 Élevée CVE-2026-8118 The Royal Addons for Elementor – Addons and Templates Kit for Elementor plugin for WordPress is vulnerable to… 6.5 Moyenne CVE-2026-6504 The Royal Elementor Addons and Templates plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the… 6.4 Moyenne

Suivre cette CVE