PatchSiren cyber security CVE debrief
CVE-2026-5428 wproyal CVE debrief
The Royal Elementor Addons plugin for WordPress is vulnerable to Stored Cross-Site Scripting via image captions in the Image Grid/Slider/Carousel widget in versions up to and including 1.7.1056. This is due to insufficient output escaping in the render_post_thumbnail() function, where wp_kses_post() is used instead of esc_attr() for the alt attribute context. This makes it possible for authenticated attackers, with Author-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses a page with the malicious image displayed in the media grid widget.
- Vendor
- wproyal
- Product
- Royal Addons for Elementor – Addons and Templates Kit for Elementor
- CVSS
- MEDIUM 6.4
- CISA KEV
- Not listed in stored evidence
- Original CVE published
- 2026-04-24
- Original CVE updated
- 2026-08-14
- Advisory published
- 2026-04-24
- Advisory updated
- 2026-08-14
Who should care
Users of the Royal Elementor Addons plugin for WordPress, particularly those with Author-level access and above, should be aware of this vulnerability and take steps to mitigate it.
Technical summary
The Royal Elementor Addons plugin for WordPress is vulnerable to Stored Cross-Site Scripting via image captions in the Image Grid/Slider/Carousel widget in versions up to and including 1.7.1056. This is due to insufficient output escaping in the render_post_thumbnail() function, where wp_kses_post() is used instead of esc_attr() for the alt attribute context. This makes it possible for authenticated attackers, with Author-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses a page with the malicious image displayed in the media grid widget. Affected product deployments should be identified and owners assigned for follow-up. The vulnerability allows for Stored Cross-Site Scripting via image captions, and users with Author-level access and above can inject web scripts. Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.
Defensive priority
Authenticated attackers with Author-level access could inject web scripts via image captions in the Image Grid/Slider/Carousel widget of the Royal Elementor Addons plugin for WordPress.
Recommended defensive actions
- Inventory and verify the version of the Royal Elementor Addons plugin for WordPress.
- Restrict access to the Image Grid/Slider/Carousel widget to prevent Author-level access and above from injecting web scripts.
- Implement additional monitoring for pages with the media grid widget displaying images.
- Apply vendor remediation when available.
- Consider compensating controls such as Web Application Firewalls.
Evidence notes
The CVE record and NVD entry provide details about the vulnerability in the Royal Elementor Addons plugin for WordPress. The vulnerability allows for Stored Cross-Site Scripting via image captions. The CVE was published on 2026-04-24T06:16:08.643Z and last modified on 2026-08-14T19:17:23.687Z.
Sources and references
Verified primary and authoritative sources
-
CVE-2026-5428 CVE Program record
Publisher, destination, and source semantics verified
URL: https://www.cve.org/CVERecord?id=CVE-2026-5428
CVE Program - Official CVE Program record with source-provided CVE metadata.
-
CVE-2026-5428 NVD vulnerability detail
Publisher, destination, and source semantics verified
URL: https://nvd.nist.gov/vuln/detail/CVE-2026-5428
NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.
Supplemental references
-
Source reference
Unverified legacy reference
URL: https://plugins.trac.wordpress.org/browser/royal-elementor-addons/tags/1.7.1049/modules/media-grid/widgets/wpr-media-grid.php
-
Source reference
Unverified legacy reference
URL: https://plugins.trac.wordpress.org/browser/royal-elementor-addons/tags/1.7.1049/modules/media-grid/widgets/wpr-media-grid.php
-
Source reference
Unverified legacy reference
URL: https://plugins.trac.wordpress.org/browser/royal-elementor-addons/trunk/modules/media-grid/widgets/wpr-media-grid.php
-
Source reference
Unverified legacy reference
URL: https://plugins.trac.wordpress.org/browser/royal-elementor-addons/trunk/modules/media-grid/widgets/wpr-media-grid.php
-
Source reference
Unverified legacy reference
URL: https://research.cleantalk.org/cve-2026-5428
Methodology and review provenance
AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.