PT-2026-36966 · Wproyal · Royal Addons For Elementor – Addons/Templates Kit For Elementor

Andrea Bocchetti · Published 2026-05-05 · Updated 2026-05-05 · CVE-2026-4803

NVD

CVSS v3.1

7.2

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N

The Royal Elementor Addons plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'status' parameter in the wpr update form action meta AJAX action in all versions up to, and including, 1.7.1056. This is due to insufficient input sanitization and output escaping, combined with a publicly leaked nonce that allows unauthenticated access to the AJAX handler. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2026-4803

Affected Products

Royal Addons For Elementor – Addons/Templates Kit For Elementor

References · 7

• https://nvd.nist.gov/vuln/detail/CVE-2026-4803 · Security Note
• https://plugins.trac.wordpress.org/browser/royal-elementor-addons/trunk/plugin.php#L613 · Note
• https://wordfence.com/threat-intel/vulnerabilities/id/c91a14d3-bc41-4490-888c-486ad2994095?source=cve · Note
• https://plugins.trac.wordpress.org/browser/royal-elementor-addons/trunk/classes/modules/forms/wpr-actions-status.php#L21 · Note
• https://plugins.trac.wordpress.org/browser/royal-elementor-addons/trunk/classes/modules/forms/wpr-actions-status.php#L73 · Note
• https://plugins.trac.wordpress.org/changeset/3503219/royal-elementor-addons/trunk/classes/modules/forms/wpr-actions-status.php · Note
• https://plugins.trac.wordpress.org/browser/royal-elementor-addons/trunk/classes/modules/forms/wpr-submissions-cpt.php#L23 · Note