{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-0664", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "state": "PUBLISHED", "assignerShortName": "Wordfence", "dateReserved": "2026-01-07T10:42:20.069Z", "datePublished": "2026-04-04T07:41:57.532Z", "dateUpdated": "2026-04-08T16:44:08.627Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T16:44:08.627Z"}, "affected": [{"vendor": "wproyal", "product": "Royal Addons for Elementor \u2013 Addons and Templates Kit for Elementor", "versions": [{"version": "0", "status": "affected", "lessThanOrEqual": "1.7.1049", "versionType": "semver"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "The Royal Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'button_text' parameter in all versions up to, and including, 1.7.1049 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page."}], "title": "Royal Elementor Addons <= 1.7.1049 - Authenticated (Contributor+) Stored Cross-Site Scripting via REST API Meta Bypass", "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/2d4225a6-4aae-49a5-93e1-8dcc9a77e089?source=cve"}, {"url": "https://plugins.trac.wordpress.org/browser/royal-elementor-addons/tags/1.7.1050/modules/form-builder/widgets/wpr-form-builder.php?marks=3754,3984-3985#L3754"}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')", "cweId": "CWE-79", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N", "baseScore": 6.4, "baseSeverity": "MEDIUM"}}], "credits": [{"lang": "en", "type": "finder", "value": "knani alaaeddine"}], "timeline": [{"time": "2025-12-29T00:00:00.000Z", "lang": "en", "value": "Discovered"}, {"time": "2026-01-07T10:58:24.000Z", "lang": "en", "value": "Vendor Notified"}, {"time": "2026-04-03T19:31:46.000Z", "lang": "en", "value": "Disclosed"}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-04-06T13:20:58.130315Z", "id": "CVE-2026-0664", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-04-06T13:21:09.522Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-0664", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-04-06T13:20:58.130315Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-04-06T13:21:03.846Z"}}], "cna": {"title": "Royal Elementor Addons <= 1.7.1049 - Authenticated (Contributor+) Stored Cross-Site Scripting via REST API Meta Bypass", "credits": [{"lang": "en", "type": "finder", "value": "knani alaaeddine"}], "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 6.4, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"}}], "affected": [{"vendor": "wproyal", "product": "Royal Addons for Elementor \u2013 Addons and Templates Kit for Elementor", "versions": [{"status": "affected", "version": "0", "versionType": "semver", "lessThanOrEqual": "1.7.1049"}], "defaultStatus": "unaffected"}], "timeline": [{"lang": "en", "time": "2025-12-29T00:00:00.000Z", "value": "Discovered"}, {"lang": "en", "time": "2026-01-07T10:58:24.000Z", "value": "Vendor Notified"}, {"lang": "en", "time": "2026-04-03T19:31:46.000Z", "value": "Disclosed"}], "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/2d4225a6-4aae-49a5-93e1-8dcc9a77e089?source=cve"}, {"url": "https://plugins.trac.wordpress.org/browser/royal-elementor-addons/tags/1.7.1050/modules/form-builder/widgets/wpr-form-builder.php?marks=3754,3984-3985#L3754"}], "descriptions": [{"lang": "en", "value": "The Royal Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'button_text' parameter in all versions up to, and including, 1.7.1049 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-79", "description": "CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')"}]}], "providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-04T07:41:57.532Z"}}}, "cveMetadata": {"cveId": "CVE-2026-0664", "state": "PUBLISHED", "dateUpdated": "2026-04-06T13:21:09.522Z", "dateReserved": "2026-01-07T10:42:20.069Z", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "datePublished": "2026-04-04T07:41:57.532Z", "assignerShortName": "Wordfence"}, "dataVersion": "5.2"}

{"cveTags": [], "descriptions": [{"lang": "en", "value": "The Royal Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'button_text' parameter in all versions up to, and including, 1.7.1049 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page."}], "id": "CVE-2026-0664", "lastModified": "2026-04-07T13:20:55.200", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.4, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 3.1, "impactScore": 2.7, "source": "security@wordfence.com", "type": "Primary"}]}, "published": "2026-04-04T08:16:05.890", "references": [{"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/royal-elementor-addons/tags/1.7.1050/modules/form-builder/widgets/wpr-form-builder.php?marks=3754,3984-3985#L3754"}, {"source": "security@wordfence.com", "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/2d4225a6-4aae-49a5-93e1-8dcc9a77e089?source=cve"}], "sourceIdentifier": "security@wordfence.com", "vulnStatus": "Awaiting Analysis", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-79"}], "source": "security@wordfence.com", "type": "Primary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "unaffected", "versions": null}], "enrichment": {"confidence": 80.0, "confidence_source": "inferred", "scores": [{"score": 80.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "product": "wordpress", "vendor": "wordpress"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,1.7.1049]"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "Royal Addons for Elementor \u2013 Addons and Templates Kit for Elementor", "source": "cna", "vendor": "wproyal"}, "product": "royal_addons_for_elementor_\u2013_addons_and_templates_kit_for_elementor", "vendor": "wproyal"}], "analysis": {"en": {"generated_at": "2026-04-04T11:23:41.687350+00:00", "value": {"mitigation_remediation": ["Upgrade to Royal Elementor Addons version 1.7.1050 or later to remove the vulnerable code.", "If an upgrade cannot be performed immediately, remove or disable the form\u2011builder widget for all contributor and lower level users.", "Consider restricting contributor role permissions so that attackers cannot access the widget interface.", "Apply a web application firewall rule that sanitizes or blocks suspicious script content submitted to button_text.", "Verify that the plugin is no longer listed as vulnerable after applying the patch and that no stored scripts remain on the site."], "summary": {"action": "Patch immediately", "impact": "Stored Cross\u2011Site Scripting that allows authenticated contributors or higher to inject and run arbitrary scripts on affected pages"}, "threat_synthesis": {"affected_systems": "The vulnerability applies to all installations of the Royal Addons for Elementor plugin up to and including version 1.7.1049. Users who run WordPress sites with this plugin and grant contributor or higher permissions to attackers are at risk.", "description_and_impact": "The Royal Elementor Addons plugin for WordPress is vulnerable to stored cross\u2011site scripting due to insufficient sanitization of the button_text parameter in its form\u2011builder widget. An authenticated user with contributor level or higher can embed malicious JavaScript that is stored and executed whenever the page is viewed. This is a classic reflected input flaw classified as CWE\u201179, enabling arbitrary script execution with the privileges of the viewing user.", "risk_and_exploitability": "The CVSS score of 6.4 indicates a medium severity, and the absence of an EPSS score or KEV listing suggests limited publicly known exploitation. However, by requiring only authenticated access, an attacker can easily create the injection and the stored nature means every subsequent visitor will be exposed. The likely attack vector is via the plugin\u2019s REST API when a contributor submits data that populates the button_text field."}}}}, "created": "2026-04-06T20:27:42.723525+00:00", "updated": "2026-04-06T22:21:01.705822+00:00", "vendors": ["wordpress", "wordpress$PRODUCT$wordpress", "wproyal", "wproyal$PRODUCT$royal_addons_for_elementor_\u2013_addons_and_templates_kit_for_elementor"]}