The Royal Elementor Addons and Templates plugin contains a stored cross‑site scripting flaw caused by insufficient sanitization of the $item['field_id'] variable and lack of output escaping. As a result, an authenticated user with Contributor privileges or higher can inject arbitrary JavaScript into form fields or other page content. When a visitor loads the affected page, the malicious script runs in the visitor’s browser, enabling data theft, session hijacking, or other client‑side attacks.

Vendors affected are the Royal Addons for Elementor – Addons and Templates Kit for Elementor. All releases up to and including version 1.7.1036 contain the vulnerability. Versions newer than 1.7.1036 are not impacted.

The CVSS score of 6.4 classifies the vulnerability as moderate severity. The EPSS score of less than 1% indicates a very low exploitation probability at present, and the issue is not listed in CISA KEV. Exploitation requires authenticated access at the Contributor level or above, and the injection payload is stored within site content, making it effective for any user who views the compromised page. The attack surface is limited to accounts with appropriate privileges, but once a payload is stored it will affect all visitors to the target page.