Stored Cross-Site Scripting Vulnerability in Royal Addons for Elementor Plugin
CVE-2026-19226
Currently unrated
Key Information:
- Vendor
WordPress
- Vendor
- CVE Published:
- 26 August 2026
Badges
👾 Exploit Exists🟡 Public PoC
What is CVE-2026-19226?
The Royal Addons for Elementor WordPress plugin, prior to version 1.7.1066, fails to properly validate certain widget settings before rendering them as HTML attributes. This oversight permits users with Contributor roles and higher to exploit the plugin, potentially leading to Stored Cross-Site Scripting attacks. An attacker could inject malicious scripts that execute in the context of other users' browsers, compromising their security and data integrity.
Affected Version(s)
Royal Addons for Elementor 0 < 1.7.1066
Exploit Proof of Concept (PoC)
PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.