{"id":"CVE-2026-112865","kind":"vulnerability","aliases":["CVE-2026-112865"],"related":[],"title":"Royal Elementor Addons WordPress plugin: DOM-based XSS through version 1.7.1069","description":"Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WProyal Royal Elementor Addons royal-elementor-addons allows DOM-Based XSS.This issue affects Royal Elementor Addons: from n/a through 1.7.1069.","summary":"The Royal Elementor Addons WordPress plugin from WProyal has a DOM-based cross-site scripting flaw in versions through 1.7.1069. An attacker can make a visitor's browser run script injected through crafted input.","severity":"medium","cvss":6.5,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["elementor","package","royal-elementor-addons","wordpress"],"not_affected_if":["plugin-not-installed"],"how_to_check":"- Check the installed version of the Royal Elementor Addons plugin (royal-elementor-addons) in the WordPress admin plugin list or the plugin header in `wp-content/plugins/royal-elementor-addons/`\n- Confirm whether the installed version is `1.7.1069` or earlier","fix":"- Update royal-elementor-addons to a version later than `1.7.1069`, as published by WProyal on WordPress.org\n- unknown for the exact patched version, as the sources do not say","status":"open","published_at":"2026-10-26T10:16:51+00:00","first_seen_at":"2026-10-26T10:29:17+00:00","triaged_at":"2026-10-26T10:30:53+00:00","updated_at":"2026-10-26T10:30:53+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-10-26T10:30:53Z","model":"claude-haiku-5-5","output":{"fix":"- Update royal-elementor-addons to a version later than `1.7.1069`, as published by WProyal on WordPress.org\n- unknown for the exact patched version, as the sources do not say","reach":"internet","title":"Royal Elementor Addons WordPress plugin: DOM-based XSS through version 1.7.1069","impact":"medium","summary":"The Royal Elementor Addons WordPress plugin from WProyal has a DOM-based cross-site scripting flaw in versions through 1.7.1069. An attacker can make a visitor's browser run script injected through crafted input.","category":"package","nicknames":[],"who_cares":["wordpress","elementor","royal-elementor-addons"],"confidence":0.6,"needs_auth":"unknown","worst_case":"Attacker runs script in visitors' browsers on the affected site.","analyst_note":"Check the NVD entry and the WordPress.org plugin changelog for the fixed version and the vulnerable input path.","how_to_check":"- Check the installed version of the Royal Elementor Addons plugin (royal-elementor-addons) in the WordPress admin plugin list or the plugin header in `wp-content/plugins/royal-elementor-addons/`\n- Confirm whether the installed version is `1.7.1069` or earlier","needs_analyst":true,"not_affected_if":["plugin-not-installed"],"who_is_affected":"Sites running the Royal Elementor Addons plugin at version 1.7.1069 or earlier are affected. Sites without the plugin installed, or running a newer release, can skip it. The sources do not say which page or input path triggers the flaw.","user_interaction":"yes","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000631,"input_tokens":3326,"output_tokens":597,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-112865':15A,18A '-2026':14A,17A '1.7.1069':12A,47B,97C 'addon':3A,24B,29B,79C,83C,93C 'affect':90C 'allow':84C 'attack':49B 'base':8A,38B,87C 'browser':55B 'craft':60B 'cross':40B,71C 'cross-sit':39B,70C 'cve':13A,16A 'dom':7A,37B,86C 'dom-bas':6A,36B,85C 'elementor':2A,19B,23B,28B,78C,82C,92C 'flaw':43B 'generat':69C 'improp':62C 'inject':58B 'input':61B,65C 'issu':89C 'make':51B 'n/a':95C 'neutral':63C 'packag':20B 'page':68C 'plugin':5A,31B 'royal':1A,22B,27B,77C,81C,91C 'royal-elementor-addon':21B,80C 'run':56B 'script':42B,57B,73C 'site':41B,72C 'version':11A,45B 'visitor':53B 'vulner':74C 'web':67C 'wordpress':4A,25B,30B 'wproyal':33B,76C 'xss':9A 'xss.this':88C","nicknames":[],"mitigations":[],"who_affected":"Sites running the Royal Elementor Addons plugin at version 1.7.1069 or earlier are affected. Sites without the plugin installed, or running a newer release, can skip it. The sources do not say which page or input path triggers the flaw.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-26T10:16:51+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L","cvss_by":"audit@patchstack.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-112865","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-112865","severity":null,"published_at":"2026-10-26T10:16:51+00:00","modified_at":"2026-10-26T10:16:51+00:00","first_seen_at":"2026-10-26T10:29:17+00:00","fetched_at":"2026-10-26T10:29:17+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}