The Royal Elementor Addons and Templates plugin for WordPress contains a stored cross‑site scripting flaw in the title_tag parameter. Insufficient sanitization permits attackers who can log in with a Contributor or higher role to embed malicious scripts in widget configurations. When any visitor loads the affected page, the injected script runs in the visitor's browser, enabling theft of session data, defacement, or additional attacks.

This issue affects the Royal Addons for Elementor – Addons and Templates Kit for Elementor plugin on WordPress sites, specifically all versions up to and including 1.7.1058. Any installation running a vulnerable version is at risk; no other vendors or products are implicated.

The vulnerability carries a CVSS score of 6.4, indicating moderate severity. EPSS data is not available and the problem is not listed in the CISA KEV catalog. The likely attack vector is an authenticated contributor who injects malicious content via the title_tag parameter. Once authenticated, an attacker can persist scripts that execute for all users who view the compromised page, creating a persistent injection risk. Although exploitation has not been publicly reported, the moderate score and potential for widespread impact make this a serious concern.