The Royal Elementor Addons plugin is vulnerable to stored cross-site scripting through image captions in the Image Grid/Slider/Carousel widget. The issue originates from insufficient escaping in the render_post_thumbnail() function, where wp_kses_post() is used for an attribute context instead of esc_attr(). This flaw allows authenticated users with Author role or higher to insert arbitrary JavaScript into image captions, which is then executed each time a page containing the malicious image is viewed by any user.

Royal Addons for Elementor – Addons and Templates Kit for Elementor is affected in all releases up to and including 1.7.1056. The vulnerability exists in the Image Grid/Slider/Carousel widget.

The CVSS base score of 6.4 indicates moderate severity. EPSS <1% indicates a very low probability of exploitation in the wild, and the issue is not listed in the CISA KEV catalog. The attack can be carried out by any user with Author level or higher, who can modify image captions. Once a malicious caption is stored, any visitor who loads a page with the image will execute the injected script, enabling actions such as cookie theft, session hijacking, or defacement.