PT-2026-36966 · WordPress · Royal Elementor Addons

Andrea Bocchetti · Published 2026-05-05 · Updated 2026-05-05 · CVE-2026-4803

Positive Technologies (AI Summary)

CVSS v3.1

7.2

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Royal Elementor Addons versions prior to 1.7.1057

Description The Royal Elementor Addons plugin for WordPress contains a Stored Cross-Site Scripting issue. This occurs due to insufficient input sanitization and output escaping in the wpr update form action meta AJAX action via the status parameter. Additionally, a publicly leaked nonce allows unauthenticated access to the AJAX handler, enabling unauthenticated attackers to inject arbitrary web scripts into pages that execute when accessed by users.

Recommendations Update the plugin to a version later than 1.7.1056.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2026-4803

Affected Products

Royal Elementor Addons

References · 12

• https://nvd.nist.gov/vuln/detail/CVE-2026-4803 · Security Note
• https://i.redd.it/v5zmm5aqqczg1.png · Reddit Post
• https://plugins.trac.wordpress.org/browser/royal-elementor-addons/trunk/classes/modules/forms/wpr-actions-status.php#L73 · Note
• https://twitter.com/CVEarity/status/2051617765841408410 · Twitter Post
• https://plugins.trac.wordpress.org/browser/royal-elementor-addons/trunk/plugin.php#L613 · Note
• https://twitter.com/VulmonFeeds/status/2051582843495530555 · Twitter Post
• https://plugins.trac.wordpress.org/changeset/3503219/royal-elementor-addons/trunk/classes/modules/forms/wpr-actions-status.php · Note
• https://plugins.trac.wordpress.org/browser/royal-elementor-addons/trunk/classes/modules/forms/wpr-actions-status.php#L21 · Note
• https://t.me/cveNotify/162133 · Telegram Post
• https://plugins.trac.wordpress.org/browser/royal-elementor-addons/trunk/classes/modules/forms/wpr-submissions-cpt.php#L23 · Note
• https://t.me/CVEtracker/52708 · Telegram Post
• https://wordfence.com/threat-intel/vulnerabilities/id/c91a14d3-bc41-4490-888c-486ad2994095?source=cve · Note