CVE-2026-107098: medium-severity vulnerability in Royal Addons for Elementor
Royal Elementor Addons 1.7.1037 - 1.7.1069 - Contributor+ Stored XSS via Google Maps Widget Height Setting
Published
33Vexday Risk Score
No sign of exploitation. It has a public proof of concept.
ssvc Attendcvss 6.8epss 0.3%
exploitation probability
0.3%top 75% of all CVEs
observed exploitation
nono source reports it
1 public exploit(s)
The Royal Addons for Elementor WordPress plugin before 1.7.1070 does not sanitise and escape one of its map widget's size settings before concatenating it into an HTML attribute, allowing users with the Contributor role or above to inject JavaScript that runs in the browser of any user who views the page, including an administrator reviewing a pending submission.
CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H
Affected products
Unknown · Royal Addons for Elementorpublic PoCs found — 1
cve_referencewpscan.com/vulnerability/36a85589-3cf3-4e9c-85fd-e0896e92fc52/unverified⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.
Related CVEs — Royal Addons for Elementor
In the same product, most dangerous first.
CVE-2026-19226MEDIUMRoyal Elementor Addons < 1.7.1066 - Contributor+ Stored XSS via Image Accordion Widget Effect SettingsEPSS 0.4%CVE-2026-13405MEDIUMRoyal Elementor Addons < 1.7.1066 - Admin+ Remote Code Execution via Widget BuilderEPSS 0.4%CVE-2026-13402MEDIUMRoyal Elementor Addons < 1.7.1063 - Unauthenticated Private Mega Menu Template DisclosureEPSS 0.3%CVE-2026-13406MEDIUMRoyal Elementor Addons < 1.7.1066 - Unauthenticated Taxonomy Term DisclosureEPSS 0.3%CVE-2026-13404MEDIUMRoyal Elementor Addons < 1.7.1066 - Unauthenticated Like Count and IP Meta Modification via wpr_likes_initEPSS 0.3%CVE-2025-11363MEDIUMRoyal Elementor Addons and Templates < 1.7.1037 - Unauthenticated Media File UploadEPSS 0.3%