Live › vulnerability › CVE-2026-112865
Go to dashboardThe Royal Elementor Addons WordPress plugin from WProyal has a DOM-based cross-site scripting flaw in versions through 1.7.1069. An attacker can make a visitor's browser run script injected through crafted input.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-26 10:29 UTC. All times on this page are UTC.
Sites running the Royal Elementor Addons plugin at version 1.7.1069 or earlier are affected. Sites without the plugin installed, or running a newer release, can skip it. The sources do not say which page or input path triggers the flaw.
No product ranges from the sources yet.
wp-content/plugins/royal-elementor-addons/1.7.1069 or earlier1.7.1069, as published by WProyal on WordPress.orgEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WProyal Royal Elementor Addons royal-elementor-addons allows DOM-Based XSS.This issue affects Royal Elementor Addons: from n/a through 1.7.1069.
This page as .md · .json · in your agent: get_signal("CVE-2026-112865")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.