{"id":"CVE-2026-107098","kind":"vulnerability","aliases":["CVE-2026-107098"],"related":[],"title":"Royal Addons for Elementor: map widget size setting enables stored cross-site scripting","description":"The Royal Addons for Elementor  WordPress plugin before 1.7.1070 does not sanitise and escape one of its map widget's size settings before concatenating it into an HTML attribute, allowing users with the Contributor role or above to inject JavaScript that runs in the browser of any user who views the page, including an administrator reviewing a pending submission.","summary":"The Royal Addons for Elementor WordPress plugin before 1.7.1070 does not sanitise or escape a map widget size setting before placing it in an HTML attribute. A user with Contributor role or higher can store JavaScript that runs in the browser of any visitor, including administrators.","severity":"medium","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["elementor","package","self-hosted","wordpress"],"not_affected_if":["only-trusted-editors","plugin-1.7.1070-or-later","plugin-not-installed"],"how_to_check":"- Check the installed version of the Royal Addons for Elementor plugin in the WordPress admin plugins list or with `wp plugin get royal-elementor-addons --field=version`\n- Look for map widgets on pages that accept Contributor submissions","fix":"- Update Royal Addons for Elementor to `1.7.1070` or later\n- Until updated, restrict Contributor-level users from editing Elementor pages","status":"open","published_at":"2026-10-28T06:16:33+00:00","first_seen_at":"2026-10-28T06:31:26+00:00","triaged_at":"2026-10-28T06:32:47+00:00","updated_at":"2026-10-28T06:32:47+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-10-28T06:32:47Z","model":"claude-haiku-5-5","output":{"fix":"- Update Royal Addons for Elementor to `1.7.1070` or later\n- Until updated, restrict Contributor-level users from editing Elementor pages","reach":"internet","title":"Royal Addons for Elementor: map widget size setting enables stored cross-site scripting","impact":"medium","summary":"The Royal Addons for Elementor WordPress plugin before 1.7.1070 does not sanitise or escape a map widget size setting before placing it in an HTML attribute. A user with Contributor role or higher can store JavaScript that runs in the browser of any visitor, including administrators.","category":"package","nicknames":[],"who_cares":["wordpress","elementor","self-hosted"],"confidence":0.7,"needs_auth":"yes","worst_case":"Injected script runs in administrators' browsers and can take over admin sessions","analyst_note":"","how_to_check":"- Check the installed version of the Royal Addons for Elementor plugin in the WordPress admin plugins list or with `wp plugin get royal-elementor-addons --field=version`\n- Look for map widgets on pages that accept Contributor submissions","needs_analyst":false,"not_affected_if":["plugin-not-installed","plugin-1.7.1070-or-later","only-trusted-editors"],"who_is_affected":"Sites running the Royal Addons for Elementor plugin before 1.7.1070 that let Contributor or higher users create or edit Elementor pages with the map widget. Sites without the plugin, or where only trusted editors can publish content, face lower risk.","user_interaction":"yes","needs_special_setup":"no","severity_if_unknown":"medium"},"cost_usd":0.000616,"input_tokens":3331,"output_tokens":566,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-107098':17A,20A '-2026':16A,19A '1.7.1070':35B,81C 'addon':2A,29B,75C 'administr':72B,127C 'allow':102C 'attribut':52B,101C 'browser':67B,117C 'concaten':96C 'contributor':56B,106C 'cross':12A 'cross-sit':11A 'cve':15A,18A 'elementor':4A,21B,31B,77C 'enabl':9A 'escap':40B,86C 'higher':59B 'host':25B 'html':51B,100C 'includ':71B,125C 'inject':111C 'javascript':62B,112C 'map':5A,42B,90C 'one':87C 'packag':22B 'page':124C 'pend':130C 'place':47B 'plugin':33B,79C 'review':128C 'role':57B,107C 'royal':1A,28B,74C 'run':64B,114C 'sanitis':38B,84C 'script':14A 'self':24B 'self-host':23B 'set':8A,45B,94C 'site':13A 'size':7A,44B,93C 'store':10A,61B 'submiss':131C 'user':54B,103C,120C 'view':122C 'visitor':70B 'widget':6A,43B,91C 'wordpress':26B,32B,78C","nicknames":[],"mitigations":[],"who_affected":"Sites running the Royal Addons for Elementor plugin before 1.7.1070 that let Contributor or higher users create or edit Elementor pages with the map widget. Sites without the plugin, or where only trusted editors can publish content, face lower risk.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-28T06:16:33+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-107098","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-107098","severity":null,"published_at":"2026-10-28T06:16:33+00:00","modified_at":"2026-10-28T06:16:33+00:00","first_seen_at":"2026-10-28T06:31:26+00:00","fetched_at":"2026-10-28T06:31:26+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}