PatchSiren cyber security CVE debrief
CVE-2026-5428 wproyal CVE debrief
The Royal Elementor Addons plugin for WordPress is vulnerable to Stored Cross-Site Scripting via image captions in the Image Grid/Slider/Carousel widget in versions up to and including 1.7.1056. This is due to insufficient output escaping in the render_post_thumbnail() function, where wp_kses_post() is used instead of esc_attr() for the alt attribute context. This makes it possible for authenticated attackers, with Author-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses a page with the malicious image displayed in the media grid widget.
- Vendor
- wproyal
- Product
- Royal Addons for Elementor – Addons and Templates Kit for Elementor
- CVSS
- MEDIUM 6.4
- CISA KEV
- Not listed in stored evidence
- Original CVE published
- 2026-04-24
- Original CVE updated
- 2026-08-14
- Advisory published
- 2026-04-24
- Advisory updated
- 2026-08-14
Who should care
Users of the Royal Elementor Addons plugin for WordPress, particularly those with Author-level access and above, should be aware of this vulnerability and take steps to mitigate it.
Technical summary
The Royal Elementor Addons plugin for WordPress is vulnerable to Stored Cross-Site Scripting via image captions in the Image Grid/Slider/Carousel widget in versions up to and including 1.7.1056. This is due to insufficient output escaping in the render_post_thumbnail() function, where wp_kses_post() is used instead of esc_attr() for the alt attribute context. This makes it possible for authenticated attackers, with Author-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses a page with the malicious image displayed in the media grid widget. Affected product deployments should be identified and owners assigned for follow-up. The vulnerability allows for Stored Cross-Site Scripting via image captions, and users with Author-level access and above can inject web scripts. Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.
Defensive priority
Authenticated attackers with Author-level access could inject web scripts via image captions in the Image Grid/Slider/Carousel widget of the Royal Elementor Addons plugin for WordPress.
Recommended defensive actions
- Inventory and verify the version of the Royal Elementor Addons plugin for WordPress.
- Restrict access to the Image Grid/Slider/Carousel widget to prevent Author-level access and above from injecting web scripts.
- Implement additional monitoring for pages with the media grid widget displaying images.
- Apply vendor remediation when available.
- Consider compensating controls such as Web Application Firewalls.
Evidence notes
The CVE record and NVD entry provide details about the vulnerability in the Royal Elementor Addons plugin for WordPress. The vulnerability allows for Stored Cross-Site Scripting via image captions. The CVE was published on 2026-04-24T06:16:08.643Z and last modified on 2026-08-14T19:17:23.687Z.
Official resources
AI-assisted PatchSiren debrief based on the supplied source corpus. The CVE record was published on 2026-04-24T06:16:08.643Z and has not been modified since then.