Skip to content
OpenAdvisories
Medium WID-SEC-2026-0968 1 CVE

WP Royal Royal Elementor Addons: Schwachstelle ermöglicht Cross-Site Scripting

Published Apr 6, 2026 · Updated Apr 6, 2026 · de-DE

Vendor: WP Royal Product: Royal Elementor Addons Platform: Linux Platform: Windows

Summary

Ein entfernter, authentisierter Angreifer kann eine Schwachstelle in WP Royal Royal Elementor Addons ausnutzen, um einen Cross-Site Scripting Angriff durchzuführen.

Product

Royal Elementor Addons ist eine vielseitige und intuitive Page Builder-Erweiterung für das WordPress Content Management System.

Vulnerabilities 1

  • Medium 6.4
    CVE-2026-0664

    Royal Elementor Addons <= 1.7.1049 - Authenticated (Contributor+) Stored Cross-Site Scripting via REST API Meta Bypass

    The Royal Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'button_text' parameter in all versions up to, and including, 1.7.1049 due to insufficient input sanitization and output escaping. This makes it possible …

    WP Royal Royal Addons for Elementor – Addons and Templates Kit for Elementor Web / CMS

Revision history

  1. #1

    Initiale Fassung

References

  • Wordfence Security Advisory vom 2026-04-06
    https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/royal-elementor-addons/royal-elementor-addons-171049-authenticated-contributor-stored-cross-site-scripting-via-rest-api-meta-bypass