CVE-2026-13407mediumCWE-116

CVE-2026-13407: medium-severity vulnerability in Royal Addons for Elementor

Royal Elementor Addons < 1.7.1067 - Unauthenticated Stored HTML Injection in Form Notification Emails

Published

Follow this CVE+ Monitor Royal Addons for Elementor

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

33Vexday Risk Score

No sign of exploitation. It has a public proof of concept.

ssvc Attendcvss 6.1epss 0.3%
The Royal Elementor Addons WordPress plugin before 1.7.1067 does not properly sanitize and escape values submitted through its form widget before including them in the body of administrator notification emails, allowing unauthenticated attackers to inject arbitrary HTML into emails sent to the site administrator on form submission.
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N
Affected products
Unknown · Royal Addons for Elementor
⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.
Related CVEs — Royal Addons for Elementor

In the same product, most dangerous first.

CVE-2026-19226MEDIUMRoyal Elementor Addons < 1.7.1066 - Contributor+ Stored XSS via Image Accordion Widget Effect SettingsEPSS 0.4%CVE-2026-13405MEDIUMRoyal Elementor Addons < 1.7.1066 - Admin+ Remote Code Execution via Widget BuilderEPSS 0.4%CVE-2026-13402MEDIUMRoyal Elementor Addons < 1.7.1063 - Unauthenticated Private Mega Menu Template DisclosureEPSS 0.3%CVE-2026-13406MEDIUMRoyal Elementor Addons < 1.7.1066 - Unauthenticated Taxonomy Term DisclosureEPSS 0.3%CVE-2026-107098MEDIUMRoyal Elementor Addons 1.7.1037 - 1.7.1069 - Contributor+ Stored XSS via Google Maps Widget Height SettingEPSS 0.3%CVE-2026-13404MEDIUMRoyal Elementor Addons < 1.7.1066 - Unauthenticated Like Count and IP Meta Modification via wpr_likes_initEPSS 0.3%