Royal Addons for Elementor stores a follow‑link text field in the database without proper sanitization or escaping, allowing an attacker with contributor or higher access to inject malicious scripts that will run whenever the affected widget is rendered on a page. This can lead to session hijacking, credential theft, defacement or other malicious client‑side activity on any user who views the content.

The vulnerability exists in the Royal Addons for Elementor plugin for WordPress, all releases up to and including version 1.7.1056. The affected product is the Instagram Feed widget, which requires that an administrator has configured it with a valid Instagram access token. Any WordPress site running a vulnerable version of this plugin is at risk.

The CVSS score of 6.4 indicates moderate severity, and the lack of an EPSS score means there is no publicly available data on current exploitation probability. The vulnerability is not listed in the CISA KEV catalog. Exploitation requires the attacker to possess at least contributor-level credentials, which may be achieved through credential compromise or social engineering. Once access is achieved, the attacker can insert arbitrary scripts that will execute in the browsers of all visitors to the affected pages.