Live › vulnerability › CVE-2026-97254
Go to dashboardThe Royal Elementor Addons WordPress plugin by WProyal does not neutralize input before rendering it into a web page, so stored cross-site scripting is possible. An attacker who can store content on the site can run JavaScript in the browser of other users, including administrators.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-26 10:29 UTC. All times on this page are UTC.
Sites running the Royal Elementor Addons plugin at version 1.7.1069 or earlier are affected. The exposure depends on who can store content that the plugin outputs, so sites where only trusted editors can write content carry less risk. Sites without this plugin can skip it.
No product ranges from the sources yet.
royal-elementor-addons) in the WordPress plugins screen or with wp plugin get royal-elementor-addons --field=version1.7.1069 or earlierroyal-elementor-addons) to a version later than 1.7.1069, per the vendor's advisory once publishedEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WProyal Royal Elementor Addons royal-elementor-addons allows Stored XSS.This issue affects Royal Elementor Addons: from n/a through 1.7.1069.
This page as .md · .json · in your agent: get_signal("CVE-2026-97254")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.