The vulnerability arises from insufficient sanitisation and escaping of user‑supplied widget attributes in the Royal Elementor Addons plugin. The flaw permits an authenticated user with contributor or higher privileges to store malicious JavaScript within a page. When any visitor loads that page the script executes in the victim’s browser, providing a vector for session hijacking, defacement, or delivery of further client‑side exploits.

All WordPress sites that install Royal Elementor Addons for Elementor up to and including version 1.7.1028 are affected. The issue is limited to the plugin’s widget functionality and affects any instance where contributor‑level or higher users create or edit widget content. Administrators who never install the plugin or use a later version are not impacted.

The CVSS score of 6.4 represents moderate severity. The EPSS score of less than 1 % suggests that widespread exploitation is unlikely at present, and the vulnerability is not listed in CISA’s KEV catalog. Exploitation requires the attacker to be authenticated and to have the ability to edit a widget; the script runs only in the browsers of other site visitors. Because the flaw does not elevate privileges or alter server‑side code, it is considered low‑to‑moderate risk for overall system compromise but can still cause significant user‑targeted attacks.