{"id":"CVE-2026-97254","kind":"vulnerability","aliases":["CVE-2026-97254"],"related":[],"title":"Royal Elementor Addons WordPress plugin: stored XSS through version 1.7.1069","description":"Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WProyal Royal Elementor Addons royal-elementor-addons allows Stored XSS.This issue affects Royal Elementor Addons: from n/a through 1.7.1069.","summary":"The Royal Elementor Addons WordPress plugin by WProyal does not neutralize input before rendering it into a web page, so stored cross-site scripting is possible. An attacker who can store content on the site can run JavaScript in the browser of other users, including administrators.","severity":"medium","cvss":6.5,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["elementor","package","self-hosted","wordpress"],"not_affected_if":["patched-version","plugin-not-installed"],"how_to_check":"- Check the installed version of Royal Elementor Addons (`royal-elementor-addons`) in the WordPress plugins screen or with `wp plugin get royal-elementor-addons --field=version`\n- Confirm whether the version is `1.7.1069` or earlier","fix":"- Update Royal Elementor Addons (`royal-elementor-addons`) to a version later than `1.7.1069`, per the vendor's advisory once published\n- unknown: a fixed version number is not stated in the sources","status":"open","published_at":"2026-10-26T10:16:53+00:00","first_seen_at":"2026-10-26T10:29:17+00:00","triaged_at":"2026-10-26T10:30:46+00:00","updated_at":"2026-10-26T10:30:46+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-10-26T10:30:46Z","model":"claude-haiku-5-5","output":{"fix":"- Update Royal Elementor Addons (`royal-elementor-addons`) to a version later than `1.7.1069`, per the vendor's advisory once published\n- unknown: a fixed version number is not stated in the sources","reach":"internet","title":"Royal Elementor Addons WordPress plugin: stored XSS through version 1.7.1069","impact":"medium","summary":"The Royal Elementor Addons WordPress plugin by WProyal does not neutralize input before rendering it into a web page, so stored cross-site scripting is possible. An attacker who can store content on the site can run JavaScript in the browser of other users, including administrators.","category":"package","nicknames":[],"who_cares":["wordpress","elementor","self-hosted"],"confidence":0.6,"needs_auth":"yes","worst_case":"Attacker script runs in other users' browsers, including administrators.","analyst_note":"","how_to_check":"- Check the installed version of Royal Elementor Addons (`royal-elementor-addons`) in the WordPress plugins screen or with `wp plugin get royal-elementor-addons --field=version`\n- Confirm whether the version is `1.7.1069` or earlier","needs_analyst":false,"not_affected_if":["plugin-not-installed","patched-version"],"who_is_affected":"Sites running the Royal Elementor Addons plugin at version 1.7.1069 or earlier are affected. The exposure depends on who can store content that the plugin outputs, so sites where only trusted editors can write content carry less risk. Sites without this plugin can skip it.","user_interaction":"yes","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.00062,"input_tokens":3323,"output_tokens":576,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-2026':12A,15A '-97254':13A,16A '1.7.1069':10A,103C 'addon':3A,26B,87C,91C,99C 'administr':69B 'affect':96C 'allow':92C 'attack':51B 'browser':64B 'content':55B 'cross':45B,79C 'cross-sit':44B,78C 'cve':11A,14A 'elementor':2A,17B,25B,86C,90C,98C 'generat':77C 'host':21B 'improp':70C 'includ':68B 'input':34B,73C 'issu':95C 'javascript':61B 'n/a':101C 'neutral':33B,71C 'packag':18B 'page':41B,76C 'plugin':5A,28B 'possibl':49B 'render':36B 'royal':1A,24B,85C,89C,97C 'royal-elementor-addon':88C 'run':60B 'script':47B,81C 'self':20B 'self-host':19B 'site':46B,58B,80C 'store':6A,43B,54B,93C 'user':67B 'version':9A 'vulner':82C 'web':40B,75C 'wordpress':4A,22B,27B 'wproyal':30B,84C 'xss':7A 'xss.this':94C","nicknames":[],"mitigations":[],"who_affected":"Sites running the Royal Elementor Addons plugin at version 1.7.1069 or earlier are affected. The exposure depends on who can store content that the plugin outputs, so sites where only trusted editors can write content carry less risk. Sites without this plugin can skip it.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-26T10:16:53+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L","cvss_by":"audit@patchstack.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-97254","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-97254","severity":null,"published_at":"2026-10-26T10:16:53+00:00","modified_at":"2026-10-26T10:16:53+00:00","first_seen_at":"2026-10-26T10:29:17+00:00","fetched_at":"2026-10-26T10:29:17+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}