CVE-2026-5428: Stored XSS in Royal Addons for Elementor Plugin via Image Caption

Vulnerability Overview Vulnerability Name: CVE-2026-5428 Vulnerability Type: Stored Cross-Site Scripting (Stored XSS) Affected Plugin: Royal Addons for Elementor Vulnerability Description: This vulnerability exists in the Royal Addons for Elementor plugin, specifically within the Image Grid, Slider, and Carousel widgets. When an author saves an image title containing a malicious script, these scripts are executed when other users access the page. Impact Scope Affected Versions: Royal Addons for Elementor <= 1.71056 Fixed Version: 1.71057 Active Installations: 600,000+ Public Disclosure Date: April 23, 2026 Last Updated Date: April 24, 2026 Remediation Recommended Action: Update the Royal Addons for Elementor plugin to version 1.71057 or higher. Developer Recommendation: Use the function to escape each title value, preventing unescaped content from being placed in HTML attributes. POC Code Timeline June 23, 2026: Plugin testing and vulnerability detection completed. June 24, 2026: Vulnerability report submitted, including POC, description, and remediation advice. April 23, 2026: CVE-2026-5428 publicly disclosed. Discovery and Exploitation Vulnerability Discovery: By reading the title data of WordPress media attachments through the Image Grid, Slider, and Carousel widgets, and using this data when constructing thumbnail markup. Exploitation Method: An author can save a title containing a malicious script; when other users access the page, the script executes in their browser. Security Recommendations User Recommendation: Update the plugin to the latest version and avoid using titles created by untrusted authors. Developer Recommendation: Use the function to escape title values to ensure content security. Related Links CVE Record: https://www.cve.org/CVERecord?id=CVE-2026-5428 Wordfence Threat Intelligence: https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/royal-elementor-addons/royal-addons-for-elementor-171056-authenticated-author-stored-cross-site-scripting-via-image-caption-field Author Information Researcher: Dmitrii Ignatyev Biography: Has 5 years of experience in WordPress and web application security, holding OSWE, OSEP, OSCP, and OSWP certifications. Other Recommendations Related Vulnerabilities: - CVE-2024-7315 - Migration, Backup, Staging - WPvivid - Unauth Sensitive Data Exposure and Database password leak - POC - CVE-2024-8619 - Ajax Search Lite - Stored XSS to backdoor creation - POC - Plugin Security Certification (PSC-2026-64629): "MailPoet" - Version 5.21.1 Footer Information CleanTalk: Provides anti-spam and plugin security certification services. Contact Us: Create a support ticket, contact us, Telegram, X, etc.

Goal Reached Thanks to every supporter — we hit 100%!

CVE-2026-5428: Stored XSS in Royal Addons for Elementor Plugin via Image Caption

More from this source