CVE-2026-5162

Royal Addons for Elementor <= 1.7.1056 - Authenticated (Contributor+) Stored Cross-Site Scripting via Instagram Feed Widget

View on CVE.org
Published Apr 17, 2026 CVSS 3.1 · 6.4 Medium EPSS < 1% KEV · Not listed
Description
The Royal Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Instagram Feed widget's 'instagram_follow_text' setting in all versions up to, and including, 1.7.1056 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

Analysis

AI-generated

Technical impact

The Royal Addons for Elementor plugin contains a stored cross‑site scripting flaw in the instagram_follow_text setting of its Instagram Feed widget. The plugin does not properly sanitize or escape user input, allowing malicious code to be stored and later rendered when any visitor loads a page containing the widget.

Affected Systems

All installations of Royal Addons for Elementor – Addons and Templates Kit for Elementor, vendor wproyal, up to and including version 1.7.1056. Any WordPress site that uses the Instagram Feed widget is affected.

Risk and Exploitability

The CVSS base score is 6.4, indicating moderate severity. No EPSS score is available and the vulnerability is not listed in the CISA KEV catalog. Exploitation requires authenticated access with Contributor level or higher, typically granted to users who can contribute content. Once authenticated, an attacker can inject scripts that execute for every site visitor who views the affected page, making the attack practical in environments where contributor permissions are not tightly controlled.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Update Royal Addons for Elementor to a version newer than 1.7.1056
  • If updating is not possible, delete or disable the Instagram Feed widget and remove all existing instances from the site
  • Restrict Contributor or higher‑level users from editing widget settings or adding widgets that include the instagram_follow_text field

Generated by OpenCVE AI on April 17, 2026 at 03:50 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories available
History
Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}
Type Values Removed Values Added
First Time appeared Wordpress
Wordpress wordpress
Wproyal
Wproyal royal Addons For Elementor – Addons And Templates Kit For Elementor
Vendors & Products Wordpress
Wordpress wordpress
Wproyal
Wproyal royal Addons For Elementor – Addons And Templates Kit For Elementor
Type Values Removed Values Added
Description The Royal Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Instagram Feed widget's 'instagram_follow_text' setting in all versions up to, and including, 1.7.1056 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Title Royal Addons for Elementor <= 1.7.1056 - Authenticated (Contributor+) Stored Cross-Site Scripting via Instagram Feed Widget
Weaknesses CWE-79
References
Metrics cvssV3_1

{'score': 6.4, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N'}
Weaknesses
  • CWE-79

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Sources

Status
PUBLISHED
Assigner
Wordfence
Published
Updated
Apr 17, 2026, 6:48 PM
Reserved
Mar 30, 2026, 2:33 PM

View source JSON

Updated
Apr 17, 2026, 6:48 PM

JSON

Status
Deferred
Published
Apr 17, 2026, 2:16 AM
Modified
Jun 17, 2026, 10:58 AM

View source JSON

No data.

Updated
Apr 17, 2026, 5:30 AM

JSON