The vulnerability allows stored cross‑site scripting due to improper neutralization of input during web page generation. An attacker who can supply malicious input that is stored by the Royal Elementor Addons plugin can later cause arbitrary script execution in the browsers of site visitors. This compromises confidentiality, integrity, and availability of the affected website and can be leveraged for phishing or hijacking user sessions.

The issue affects the WordPress Royal Elementor Addons plugin from the earliest available version through 1.7.1069. Users of this plugin on any WordPress installation are vulnerable; the affected vendor is WProyal.

The CVSS score of 6.5 indicates a medium‑to‑high severity for executing arbitrary code on the client side. EPSS is not available, so the current estimate of exploitation probability is unknown. Since the vulnerability is not listed in CISA KEV, there is no known large‑scale exploitation at present. The likely attack vector is via the plugin’s administrative interface where users can submit content that is later displayed on public pages. An attacker who gains access to that interface or who can find a way to inject malicious content into the plugin’s data store can trigger the XSS.