The Royal Elementor Addons plugin contains an improper neutralization of input during web page generation that allows a malicious actor to inject and execute JavaScript in the context of a vulnerable website. The flaw is a DOM‑based XSS, which can lead to theft of user session cookies, data exfiltration, or drive‑by compromise of visitors. The impact is limited to the client side of the affected site and is not solely limited to privileged accounts; it is inferred that any visitor who views a page rendering the injected input could be affected, as the description does not specify authentication requirements.

All WordPress installations that have the Royal Elementor Addons plugin up to and including version 1.7.1069 are potentially affected. Vendors must identify any sites using the WProyal Royal Elementor Addons add‑on and verify the installed version. No specific operating system or server configuration is listed as a restriction.

The CVSS base score of 6.5 denotes moderate severity, with the available information indicating a moderate attack vector. The EPSS score is not available, so no quantitative exploitation probability is provided. As the vulnerability is not listed in the CISA KEV, there is no current evidence of widespread exploitation.