CVE-2026-0664: Royal Addons for Elementor XSS Vulnerability

CVE-2026-0664 Overview

The Royal Addons for Elementor plugin for WordPress contains a Stored Cross-Site Scripting (XSS) vulnerability in the button_text parameter affecting all versions up to and including 1.7.1049. The flaw stems from insufficient input sanitization and output escaping within the Form Builder widget, enabling authenticated attackers with contributor-level access or higher to inject arbitrary web scripts into pages. These malicious scripts execute whenever any user accesses the compromised page, potentially leading to session hijacking, credential theft, or further site compromise.

Critical Impact

Authenticated attackers can persistently inject malicious JavaScript that executes in the context of other users' sessions, including administrators, potentially leading to full site compromise.

Affected Products

• Royal Addons for Elementor WordPress Plugin versions up to and including 1.7.1049
• WordPress sites utilizing the Royal Addons for Elementor Form Builder widget
• Any WordPress installation where contributors or higher-privileged users have access to the vulnerable plugin

Discovery Timeline

• 2026-04-04 - CVE-2026-0664 published to NVD
• 2026-04-07 - Last updated in NVD database

Technical Details for CVE-2026-0664

Vulnerability Analysis

This Stored Cross-Site Scripting vulnerability exists within the Form Builder widget component of the Royal Addons for Elementor plugin. The vulnerability is classified under CWE-79 (Improper Neutralization of Input During Web Page Generation). The attack requires network access and low privileges (contributor-level), but requires no user interaction to exploit. The scope is changed, meaning the vulnerable component impacts resources beyond its security scope, affecting both confidentiality and integrity of user sessions.

When a contributor or higher-privileged user creates or edits a form using the Form Builder widget, the button_text parameter value is stored in the database without proper sanitization. Subsequently, when the page containing this form is rendered to any visitor, the malicious payload executes in their browser context.

Root Cause

The root cause is insufficient input sanitization and inadequate output escaping in the wpr-form-builder.php file. The plugin fails to properly validate and encode user-supplied input in the button_text parameter before storing it in the database and rendering it on the frontend. This allows HTML and JavaScript content to be injected and executed rather than being treated as plain text.

Attack Vector

The attack vector is network-based and requires the attacker to have at least contributor-level access to the WordPress site. The attacker exploits the vulnerability by:

1. Accessing the Elementor editor as a contributor or higher-privileged user
2. Adding or editing a Form Builder widget from Royal Addons
3. Injecting malicious JavaScript payload into the button_text parameter
4. Publishing or updating the page containing the form
5. The payload persists in the database and executes whenever any user views the page

The vulnerability is particularly dangerous because stored XSS payloads persist and can affect multiple users including site administrators, potentially enabling privilege escalation or full site takeover. For technical details on the affected code, see the WordPress Plugin Code Review.

Detection Methods for CVE-2026-0664

Indicators of Compromise

• Unexpected JavaScript or HTML content in Form Builder widget button text fields
• Unusual form elements containing <script> tags, event handlers (onclick, onerror, onload), or encoded payloads
• Suspicious modifications to pages containing Royal Addons Form Builder widgets by contributor-level users
• Reports from users of unexpected browser behavior or redirects when viewing pages with forms

Detection Strategies

• Review WordPress database for entries containing script tags or JavaScript event handlers in Royal Addons form configurations
• Implement Content Security Policy (CSP) headers to detect and prevent inline script execution
• Enable WordPress audit logging to track changes made to pages and widgets by contributor-level users
• Use web application firewalls (WAF) with XSS detection rulesets to identify exploitation attempts

Monitoring Recommendations

• Monitor for unusual JavaScript execution patterns on pages containing Form Builder widgets
• Set up alerts for modifications to Royal Addons for Elementor widget configurations
• Review access logs for patterns of contributor accounts editing multiple pages containing forms
• Implement real-time monitoring for DOM modifications and suspicious script injections using browser security tools

How to Mitigate CVE-2026-0664

Immediate Actions Required

• Update Royal Addons for Elementor plugin to version 1.7.1050 or later immediately
• Audit all existing Form Builder widgets for suspicious content in the button_text parameter
• Review and restrict contributor-level access where not strictly necessary
• Implement Content Security Policy headers to mitigate XSS impact
• Consider temporarily disabling the Form Builder widget if immediate patching is not possible

Patch Information

The vulnerability has been addressed in Royal Addons for Elementor version 1.7.1050. The patch implements proper input sanitization and output escaping for the button_text parameter in the Form Builder widget. For detailed vulnerability information and patch verification, refer to the Wordfence Vulnerability Report.

Workarounds

• Restrict contributor-level access to only trusted users until the patch is applied
• Implement a Web Application Firewall (WAF) with XSS protection rules to filter malicious input
• Use Content Security Policy headers with strict script-src directives to prevent inline script execution
• Manually sanitize existing Form Builder widget content by reviewing and removing any suspicious payloads
• Consider using alternative form plugins until the vulnerable plugin is updated

# Configuration example - Add CSP headers to wp-config.php or .htaccess
# For Apache (.htaccess):
Header set Content-Security-Policy "default-src 'self'; script-src 'self' 'unsafe-inline' https://trusted-cdn.com; style-src 'self' 'unsafe-inline';"

# For Nginx (nginx.conf):
add_header Content-Security-Policy "default-src 'self'; script-src 'self' 'unsafe-inline' https://trusted-cdn.com; style-src 'self' 'unsafe-inline';";