{"id":"CVE-2026-119518","kind":"vulnerability","aliases":["CVE-2026-119518"],"related":[],"title":"Royal Elementor Addons: stored cross-site scripting through version 1.7.1070 allows script injection","description":"Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WProyal Royal Elementor Addons royal-elementor-addons allows Stored XSS.This issue affects Royal Elementor Addons: from n/a through 1.7.1070.","summary":"Royal Elementor Addons is a WordPress plugin for Elementor page builder sites. A flaw in its input handling lets an attacker store malicious script that runs in other users' browsers when they view the affected pages.","severity":"medium","cvss":6.5,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"Royal Elementor Addons","fixed":[],"affected":"","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["elementor","other","royal-elementor-addons","wordpress"],"not_affected_if":["plugin-not-installed"],"how_to_check":"- Check the installed Royal Elementor Addons version in the WordPress Plugins screen; versions through `1.7.1070` are listed as affected.","fix":null,"status":"open","published_at":"2026-11-13T13:17:54+00:00","first_seen_at":"2026-11-13T13:46:51+00:00","triaged_at":"2026-11-13T13:48:03+00:00","updated_at":"2026-11-13T13:48:03+00:00","category":"other","confidence":0.7,"triage":{"at":"2026-11-13T13:48:03Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"unknown","title":"Royal Elementor Addons: stored cross-site scripting through version 1.7.1070 allows script injection","impact":"medium","summary":"Royal Elementor Addons is a WordPress plugin for Elementor page builder sites. A flaw in its input handling lets an attacker store malicious script that runs in other users' browsers when they view the affected pages.","audience":"businesses","category":"other","nicknames":[],"who_cares":["wordpress","elementor","royal-elementor-addons"],"confidence":0.7,"fix_status":"unknown","needs_auth":"unknown","worst_case":"attacker runs scripts in visitors' browsers on the site","analyst_note":"","how_to_check":"- Check the installed Royal Elementor Addons version in the WordPress Plugins screen; versions through `1.7.1070` are listed as affected.\n- unknown","plain_action":"","product_name":"Royal Elementor Addons","needs_analyst":false,"not_affected_if":["plugin-not-installed"],"who_is_affected":"Sites running the Royal Elementor Addons WordPress plugin at or below version 1.7.1070 are exposed. Sites without this plugin, or running a newer version, can skip it. The sources do not say whether an account is needed to store the malicious input.","user_interaction":"unknown","product_ecosystem":"vendor","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.001219,"input_tokens":4559,"output_tokens":1527,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-119518':17A,20A '-2026':16A,19A '1.7.1070':11A,100C 'addon':3A,29B,33B,84C,88C,96C 'addons':23A 'affect':65B,93C 'allow':12A,89C 'attack':51B 'browser':60B 'builder':41B 'cross':6A,76C 'cross-sit':5A,75C 'cve':15A,18A 'elementor':2A,22A,24B,28B,32B,39B,83C,87C,95C 'flaw':44B 'generat':74C 'handl':48B 'improp':67C 'inject':14A 'input':47B,70C 'issu':92C 'let':49B 'malici':53B 'n/a':98C 'neutral':68C 'page':40B,66B,73C 'plugin':37B 'royal':1A,21A,27B,31B,82C,86C,94C 'royal-elementor-addon':26B,85C 'run':56B 'script':8A,13A,54B,78C 'site':7A,42B,77C 'store':4A,52B,90C 'user':59B 'version':10A 'view':63B 'vulner':79C 'web':72C 'wordpress':30B,36B 'wproyal':81C 'xss.this':91C","nicknames":[],"mitigations":[],"who_affected":"Sites running the Royal Elementor Addons WordPress plugin at or below version 1.7.1070 are exposed. Sites without this plugin, or running a newer version, can skip it. The sources do not say whether an account is needed to store the malicious input.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":["elementoraddons","royalelementoraddons"],"ptokens":["addons","elementor","royal"],"labels":["elementor","medium","other","royalelementoraddons","vendor","wordpress"],"campaign_type":null,"search_a":"'-119518':17A,20A '-2026':16A,19A '1.7.1070':11A 'addon':3A 'addons':23A 'allow':12A 'cross':6A 'cross-sit':5A 'cve':15A,18A 'elementor':2A,22A 'inject':14A 'royal':1A,21A 'script':8A,13A 'site':7A 'store':4A 'version':10A","search_b":"'addon':29B,33B 'affect':65B 'attack':51B 'browser':60B 'builder':41B 'elementor':24B,28B,32B,39B 'flaw':44B 'handl':48B 'input':47B 'let':49B 'malici':53B 'page':40B,66B 'plugin':37B 'royal':27B,31B 'royal-elementor-addon':26B 'run':56B 'script':54B 'site':42B 'store':52B 'user':59B 'view':63B 'wordpress':30B,36B","search_c":"'1.7.1070':100C 'addon':84C,88C,96C 'affect':93C 'allow':89C 'cross':76C 'cross-sit':75C 'elementor':83C,87C,95C 'generat':74C 'improp':67C 'input':70C 'issu':92C 'n/a':98C 'neutral':68C 'page':73C 'royal':82C,86C,94C 'royal-elementor-addon':85C 'script':78C 'site':77C 'store':90C 'vulner':79C 'web':72C 'wproyal':81C 'xss.this':91C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-13T13:17:54+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L","cvss_by":"audit@patchstack.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-119518","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-119518","severity":null,"published_at":"2026-11-13T13:17:54+00:00","modified_at":"2026-11-13T13:17:54+00:00","first_seen_at":"2026-11-13T13:46:51+00:00","fetched_at":"2026-11-13T13:46:51+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}