XSS in Royal Addons For Elementor

CVE-2026-107098

The Royal Addons for Elementor WordPress plugin before 1.7.1070 does not sanitise and escape one of its map widget's size settings before concatenating it into an HTML attribute, allowing users with the Contributor role or above to inject JavaScript that runs in the browser of any user who views the page, including an administrator reviewing a pending submission.

Vulnerability class: XSS (Cross-Site Scripting)

Published · last modified .

CVSS v3 metric

CVSS v3 base score 6.8 (Medium). Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H.

EPSS exploit prediction

EPSS: 0.002 (6.5th percentile), scored .

Very low probability of exploitation in the next 30 days; routine patching cadence is appropriate. 6th percentile — 6.5% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.

The 30-day trend appears once there are two daily scores.

Affected products

  • Royal Addons For Elementor

Weakness classification (CWE)

References

Frequently asked questions

What is CVE-2026-107098?
CVE-2026-107098 is a medium-severity vulnerability in Royal Addons For Elementor, classified under Cross-site Scripting. CVSS score: 6.8/10. Published 2026-10-28.
How severe is CVE-2026-107098?
Medium severity. CVSS v3 base score is 6.8 out of 10.