Live › vulnerability › CVE-2026-111851
Go to dashboardThe Royal Elementor Addons plugin for WordPress selects classes or code based on externally controlled input, so an attacker can inject code. Affected versions run up to and including 1.7.1068.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Sites running the Royal Elementor Addons WordPress plugin at version or earlier are affected. The sources do not say which settings or roles are needed to reach the flaw, so unknown whether sites without the plugin's features enabled are safe.
1.7.1068No product ranges from the sources yet.
wp plugin get royal-elementor-addons --field=version1.7.1068Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection') vulnerability in WProyal Royal Elementor Addons royal-elementor-addons allows Code Injection.This issue affects Royal Elementor Addons: from n/a through 1.7.1068.
This page as .md · .json · in your agent: get_signal("CVE-2026-111851")
NVD data is provided by NIST and is public domain · EPSS scores by FIRST, used with attribution. Posts quoted belong to their authors.