Improper neutralization of input during web page generation, a stored cross‑site scripting vulnerability, is present in the Royal Elementor Addons plugin. The flaw allows attackers to save malicious scripts in plugin fields that are rendered on the site, leading to script execution in the browsers of anyone who views the affected content. Although it does not provide direct remote code execution, the injected scripts can steal session cookies, deface content, or redirect users, compromising confidentiality and integrity of user sessions.

The vulnerability affects the WProyal Royal Elementor Addons plugin for WordPress, specifically all releases older than 1.7.1053. Any WordPress installation that has this plugin version installed is susceptible until the plugin is updated.

The CVSS base score of 6.5 indicates moderate severity. No EPSS score is available, suggesting a low or unknown probability of active exploitation at this time, and the vulnerability is not listed in CISA’s KEV catalog. Based on the description, it is inferred that an attacker would need to add or modify content in the plugin fields, which typically requires authenticated access; however, the CVE data does not explicitly state the required privileges. Once malicious scripts are stored, they are executed in the browsers of any visitors to the affected pages, providing persistent risk until the plugin is upgraded.