The Royal Elementor Addons and Templates plugin for WordPress contains a stored cross‑site scripting flaw in the widgetGrid, widgetCountDown, and widgetInstagramFeed methods. Authenticated contributors or higher can inject malicious JavaScript that is subsequently rendered in any page that displays the affected widget. The injected code will run under the context of every visitor to the page, potentially allowing attackers to steal session cookies, deface content, or launch phishing attacks.

WordPress installations that include the Royal Elementor Addons and Templates plugin version 1.7.1012 or earlier. These versions expose the vulnerable widget rendering functions and do not provide the required input sanitisation or output escaping.

The vulnerability has a CVSS score of 6.4, indicating moderate severity, and an EPSS score of < 1 %, suggesting that active exploitation is currently unlikely. It is not listed in the CISA KEV catalog. The attack vector requires the attacker to be authenticated with Contributor‑level access or higher; the injected payload will then affect any visitor who views a page containing the compromised widget.