CVE-2026-13405

Name of the Vulnerable Software and Affected Versions Royal Addons for Elementor versions prior to 1.7.1066

Description Insufficient sanitization of custom widget markup occurs before it is written to a file that is subsequently executed. This allows users with the manage options capability, as well as non-super subsite administrators on WordPress Multisite installations who lack other code-execution privileges, to execute arbitrary PHP code.

Recommendations Update Royal Addons for Elementor to version 1.7.1066 or later.