Stored Cross-Site Scripting Vulnerability in Royal Elementor Addons by WordPress

CVE-2025-5338

What is CVE-2025-5338?

The Royal Elementor Addons plugin for WordPress is affected by a vulnerability that allows authenticated attackers with contributor-level access and above to perform Stored Cross-Site Scripting attacks. This occurs due to insufficient input sanitization and output escaping on user-supplied attributes in multiple widgets. As a result, attackers can inject arbitrary web scripts into pages, leading to potential exploitation whenever a user accesses the compromised page.

References