The Royal Elementor Addons plugin for WordPress is vulnerable to stored cross‑site scripting due to insufficient sanitization of the button_text parameter in its form‑builder widget. An authenticated user with contributor level or higher can embed malicious JavaScript that is stored and executed whenever the page is viewed. This is a classic reflected input flaw classified as CWE‑79, enabling arbitrary script execution with the privileges of the viewing user.

The vulnerability applies to all installations of the Royal Addons for Elementor plugin up to and including version 1.7.1049. Users who run WordPress sites with this plugin and grant contributor or higher permissions to attackers are at risk.

The CVSS score of 6.4 indicates a medium severity, and the absence of an EPSS score or KEV listing suggests limited publicly known exploitation. However, by requiring only authenticated access, an attacker can easily create the injection and the stored nature means every subsequent visitor will be exposed. The likely attack vector is via the plugin’s REST API when a contributor submits data that populates the button_text field.