CVE-2026-6504

Name of the Vulnerable Software and Affected Versions Royal Elementor Addons and Templates versions prior to 1.7.1059

Description The Royal Elementor Addons and Templates plugin for WordPress contains a Stored Cross-Site Scripting issue caused by insufficient input sanitization and output escaping. Authenticated attackers with Contributor-level access or higher can inject arbitrary web scripts through the title tag parameter. These scripts execute whenever a user visits the affected page.

Recommendations Update the plugin to a version later than 1.7.1058. As a temporary workaround, restrict access for users with Contributor-level permissions to prevent the use of the title tag parameter.