{
 "id": "WPSEC-2026-1589",
 "url": "https://wpsec.com/vuln/WPSEC-2026-1589/",
 "json_url": "https://wpsec.com/vuln/WPSEC-2026-1589/advisory.json",
 "markdown_url": "https://wpsec.com/vuln/WPSEC-2026-1589/index.md",
 "title": "Royal Addons for Elementor <= 1.7.1069 - Authenticated (Contributor+) Stored Cross-Site Scripting via Google Maps Widget 'Map Height' Setting",
 "description": "The Royal Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Google Maps widget's 'Map Height' setting, used when the map is embedded without an API key, in all versions up to, and including, 1.7.1069 due to insufficient input sanitization and output escaping of the value in an HTML attribute. This makes it possible for authenticated attackers with Contributor-level access and above who can edit content with Elementor to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.",
 "plugin": {
  "slug": "royal-elementor-addons",
  "name": "Royal Addons for Elementor",
  "full_name": "Royal Addons for Elementor – Addons and Templates Kit for Elementor",
  "wordpress_org": "https://wordpress.org/plugins/royal-elementor-addons/",
  "advisories_url": "https://wpsec.com/vuln/plugin/royal-elementor-addons/",
  "attacksurface": "https://attacksurface.wpsec.com/plugin/royal-elementor-addons"
 },
 "type": "XSS",
 "cwe": [
  "CWE-79"
 ],
 "cve": [],
 "cvss": {
  "version": "3.1",
  "score": 6.4,
  "vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N",
  "severity": "Medium"
 },
 "affected": {
  "ranges": [
   {
    "from": null,
    "from_inclusive": true,
    "to": "1.7.1070",
    "to_inclusive": false
   }
  ],
  "text": [
   "all versions before 1.7.1070"
  ]
 },
 "introduced_in": null,
 "fixed_in": "1.7.1070",
 "remediation": "Update to 1.7.1070 or later.",
 "fix_released": "2026-10-23T07:34:01+00:00",
 "published": "2026-10-24T07:43:16+00:00",
 "updated": "2026-10-23T09:48:22.372115+00:00",
 "also_published_as": null,
 "references": [
  "https://wpsec.com/vuln/WPSEC-2026-1589/",
  "https://plugins.svn.wordpress.org/royal-elementor-addons/tags/1.7.1070/",
  "https://wordpress.org/plugins/royal-elementor-addons/"
 ],
 "attacksurface_url": "https://attacksurface.wpsec.com/plugin/royal-elementor-addons",
 "source": "WPSec",
 "license": {
  "name": "CC BY 4.0",
  "url": "https://creativecommons.org/licenses/by/4.0/"
 },
 "usage": {
  "plugin": "High",
  "affected_versions": "High",
  "as_of": "2026-10-24"
 }
}