Royal Addons for Elementor, before version 1.7.1070, fails to sanitize a map widget size setting that is inserted into an HTML attribute. The unsanitized input allows anyone with a Contributor role or above to inject JavaScript that runs in the browsers of all users who view the page, including administrators reviewing pending submissions. The primary impact is the execution of attacker‑supplied code in client browsers, which can lead to credential theft, session hijacking, or the execution of further attacks.

This issue affects the Royal Addons for Elementor WordPress plugin, versions 1.7.1037 through 1.7.1069 inclusive. The plugin is distributed under the Royal Addons package and is commonly used in WordPress sites. No other vendors or product lines are reported to be impacted.

The flaw is a stored XSS that requires a user with Contributor or higher privileges to insert the payload. Once embedded, the malicious code runs automatically in the browsers of any visitor to the page, regardless of their role. No external network exploitation is required. As of the current data, no public exploit releases are available and the EPSS score is not disclosed. The vulnerability is not listed in CISA KEV. The most likely attack vector is an authorized editor using the Google Maps widget height setting to inject unsanitized JavaScript.