Live › vulnerability › CVE-2026-107098
Go to dashboardThe Royal Addons for Elementor WordPress plugin before 1.7.1070 does not sanitise or escape a map widget size setting before placing it in an HTML attribute. A user with Contributor role or higher can store JavaScript that runs in the browser of any visitor, including administrators.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-28 06:31 UTC. All times on this page are UTC.
Sites running the Royal Addons for Elementor plugin before 1.7.1070 that let Contributor or higher users create or edit Elementor pages with the map widget. Sites without the plugin, or where only trusted editors can publish content, face lower risk.
No product ranges from the sources yet.
wp plugin get royal-elementor-addons --field=version1.7.1070 or laterEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
The Royal Addons for Elementor WordPress plugin before 1.7.1070 does not sanitise and escape one of its map widget's size settings before concatenating it into an HTML attribute, allowing users with the Contributor role or above to inject JavaScript that runs in the browser of any user who views the page, including an administrator reviewing a pending submission.
This page as .md · .json · in your agent: get_signal("CVE-2026-107098")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.