Code Injection Vulnerability in Royal Elementor Addons by WProyal
CVE-2026-111851

7.6HIGH

Key Information:

Vendor

WordPress
Status
Royal Elementor Addons
Vendor
CVE Published:
22 October 2026

What is CVE-2026-111851?

A vulnerability exists in the Royal Elementor Addons developed by WProyal, allowing an attacker to exploit externally-controlled input for arbitrary code execution. This risk arises from unsafe reflection mechanisms that fail to properly validate user inputs. Versions affected include 1.7.1068, potentially allowing unauthorized users to execute malicious scripts, leading to compromised website integrity and security.

Affected Version(s)

Royal Elementor Addons 0 <= 1.7.1068

References

https://patchstack.com/database/wordpress/plugin/royal-el...
vdb-entry

CVSS V3.1

Score:
7.6
Severity:
HIGH
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Intrudify | Patchstack Bug Bounty Program
.