CVE-2026-107098
The Royal Addons for Elementor WordPress plugin before 1.7.1070 does not sanitise and escape one…
- Risk score
- 41/100
- CVSS
- 6.8 v3.1
- Published
- 28 Oct 2026
Open in the live forecast Today's forecast
What to know
- What it is
- The Royal Addons for Elementor WordPress plugin before 1.7.1070 does not sanitise and escape one of its map widget's size settings before concatenating it into an HTML attribute, allowing users with the Contributor role or above to inject JavaScript that runs in the browser of any user who views the page, including an…
- Affected
- See advisory
- Fix
- Upgrade the product to 1.7.1070 or later.
- Exploitation
- No known exploitation
Why it is Yellow
- CVSS 6.8 medium
References
Original description
The Royal Addons for Elementor WordPress plugin before 1.7.1070 does not sanitise and escape one of its map widget's size settings before concatenating it into an HTML attribute, allowing users with the Contributor role or above to inject JavaScript that runs in the browser of any user who views the page, including an administrator reviewing a pending submission.
Last activity 28 Oct 2026. Patch Forecast updates every hour.