Vulnerabilities / Royal Addons for Elementor / WPSEC-2026-1589
Royal Addons for Elementor <= 1.7.1069 - Authenticated (Contributor+) Stored Cross-Site Scripting via Google Maps Widget 'Map Height' Setting
Medium 6.4
CWE-79Fixed in 1.7.1070
- ID
- WPSEC-2026-1589
- Plugin
- Royal Addons for Elementor – Addons and Templates Kit for Elementor (royal-elementor-addons)
- Affected
- all versions before 1.7.1070
- Remediation
- Update to 1.7.1070 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
- Weakness
- CWE-79
- Usage
- Plugin High · Affected versions High among sites WPSec scans, 2026-10-24
- Attack surface
- Royal Addons for Elementor on WPSec AttackSurface
- Fix released
- Published
Description
The Royal Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Google Maps widget's 'Map Height' setting, used when the map is embedded without an API key, in all versions up to, and including, 1.7.1069 due to insufficient input sanitization and output escaping of the value in an HTML attribute. This makes it possible for authenticated attackers with Contributor-level access and above who can edit content with Elementor to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
References
- https://wpsec.com/vuln/WPSEC-2026-1589/
- https://plugins.svn.wordpress.org/royal-elementor-addons/tags/1.7.1070/
- https://wordpress.org/plugins/royal-elementor-addons/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS