WID-SEC-2025-1410 — WP Royal Royal Elementor Addons: Schwachstelle ermöglicht Cross-Site Scripting

Summary

Ein entfernter, authentisierter Angreifer kann eine Schwachstelle in WP Royal Royal Elementor Addons ausnutzen, um einen Cross-Site Scripting Angriff durchzuführen.

Product

Royal Elementor Addons ist eine vielseitige und intuitive Page Builder-Erweiterung für das WordPress Content Management System.

Vulnerabilities 1

Medium 6.4

CVE-2025-5338

Royal Elementor Addons <= 1.7.1028 - Authenticated (Contributor+) Stored DOM-Based Cross-Site Scripting via Multiple Widgets

The Royal Elementor Addons plugin for WordPress is vulnerable to Stored Cross-Site Scripting via multiple widgets in all versions up to, and including, 1.7.1028 due to insufficient input sanitization and output escaping on user supplied attributes. This makes…

WP Royal Royal Addons for Elementor – Addons and Templates Kit for Elementor Web / CMS

Jun 26, 2025

Revision history

2025-06-26 #1
Initiale Fassung

References

Wordfence Vulnerability Database vom 2025-06-26
https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/royal-elementor-addons/royal-elementor-addons-171024-authenticated-contributor-stored-dom-based-cross-site-scripting-via-multiple-widgets
GitHub Security Advisory GHSA-53r4-4j62-6j4c vom 2025-06-26
https://github.com/advisories/GHSA-53r4-4j62-6j4c