---
id: "CVE-2026-111851"
kind: "vulnerability"
aliases: ["CVE-2026-111851"]
title: "Royal Elementor Addons WordPress plugin: unsafe reflection allows code injection"
severity: "high"
cvss: 7.6
epss: 0.002
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["elementor", "package", "self-hosted", "wordpress"]
not_affected_if: ["plugin-not-installed"]
published_at: "2026-10-22T09:17:13+00:00"
first_seen_at: "2026-10-23T21:57:30+00:00"
updated_at: "2026-10-25T03:14:24+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-111851", "first_seen_at": "2026-10-23T21:57:30+00:00"}, {"source": "epss", "url": "https://api.first.org/data/v1/epss?cve=CVE-2026-111851", "first_seen_at": "2026-10-24T07:15:52+00:00"}]
---

# Royal Elementor Addons WordPress plugin: unsafe reflection allows code injection

The Royal Elementor Addons plugin for WordPress selects classes or code based on externally controlled input, so an attacker can inject code. Affected versions run up to and including 1.7.1068.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed version of Royal Elementor Addons (royal-elementor-addons) in the WordPress plugins screen or `wp plugin get royal-elementor-addons --field=version`
- unknown for other checks

## Fix

- Update Royal Elementor Addons to a version later than `1.7.1068`
- unknown for a fixed version number

## Timeline

- 2026-10-23T21:57:30+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-111851
- 2026-10-24T07:15:52+00:00 epss https://api.first.org/data/v1/epss?cve=CVE-2026-111851

## From the sources

Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection') vulnerability in WProyal Royal Elementor Addons royal-elementor-addons allows Code Injection.This issue affects Royal Elementor Addons: from n/a through 1.7.1068.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_