CVE-2026-40720: Royal Elementor Addons Pro XSS Vulnerability

CVE-2026-40720 Overview

CVE-2026-40720 is an unauthenticated Cross-Site Scripting (XSS) vulnerability affecting the Royal Elementor Addons Pro plugin for WordPress in versions prior to 1.7.1041. The flaw is categorized under [CWE-79], improper neutralization of input during web page generation. An unauthenticated attacker can inject malicious script content that executes in a victim's browser when the crafted payload is rendered. Successful exploitation requires user interaction, such as visiting a maliciously crafted URL or page. The vulnerability impacts confidentiality, integrity, and availability at a limited scope and can pivot into session theft, credential capture, or unauthorized actions performed on behalf of authenticated users including administrators.

Critical Impact
Unauthenticated attackers can execute arbitrary JavaScript in a victim's browser, enabling session hijacking, administrative account takeover, and persistent compromise of WordPress sites running vulnerable Royal Elementor Addons Pro versions.

Affected Products

Royal Elementor Addons Pro plugin for WordPress
Versions prior to 1.7.1041
WordPress sites with the wpr-addons-pro plugin enabled

Discovery Timeline

2026-06-17 - CVE-2026-40720 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2026-40720

Vulnerability Analysis

The vulnerability is a reflected or stored Cross-Site Scripting (XSS) flaw in the Royal Elementor Addons Pro plugin. The plugin fails to properly neutralize user-supplied input before including it in HTML output rendered to site visitors. Because the issue is reachable without authentication, any visitor or guest can supply attacker-controlled input that the application later echoes back into a rendered page. When a victim loads the affected page or follows a crafted link, the browser parses and executes the injected script in the context of the WordPress site origin.

The scope is marked as changed, indicating the injected script can affect resources beyond the vulnerable component, such as the administrative dashboard or other authenticated sessions. Attackers commonly leverage XSS in WordPress plugins to exfiltrate session cookies, create rogue administrator accounts, inject SEO spam, or load secondary payloads that pivot to remote code execution through plugin installation.

Root Cause

The root cause is missing or insufficient output encoding and input sanitization in one or more request handlers exposed by the wpr-addons-pro plugin. User-controllable parameters are concatenated into HTML responses without applying WordPress sanitization primitives such as esc_html(), esc_attr(), or wp_kses(). This allows raw <script> tags or event handler attributes to survive into the DOM.

Attack Vector

The attack is delivered over the network with low complexity and no privileges, but requires user interaction (UI:R). A typical exploitation path involves an attacker crafting a URL containing a malicious payload in a vulnerable parameter and distributing it through phishing, social media, or referrer-based vectors. When an authenticated administrator visits the link, the script executes with their privileges, enabling actions such as nonce theft, settings modification, or plugin uploads. The vulnerability mechanism is detailed in the Patchstack Vulnerability Report.

Detection Methods for CVE-2026-40720

Indicators of Compromise

Unexpected <script> tags, onerror=, onload=, or javascript: URIs in WordPress post content, plugin settings, or rendered pages served by the wpr-addons-pro plugin.
New or unrecognized WordPress administrator accounts created shortly after suspicious traffic to plugin endpoints.
Outbound requests from administrator browsers to unknown domains immediately after loading pages rendered by Royal Elementor Addons Pro.
Modified plugin or theme files containing obfuscated JavaScript or PHP webshells installed post-exploitation.

Detection Strategies

Inspect web server access logs for requests to wpr-addons-pro endpoints containing URL-encoded <script>, %3Cscript, onerror, or javascript: substrings.
Deploy a Web Application Firewall (WAF) with rules targeting reflected XSS payloads in query strings and POST bodies destined for WordPress plugin routes.
Run the WordPress site through Patchstack, WPScan, or equivalent vulnerability scanners to confirm the installed plugin version is 1.7.1041 or later.
Monitor browser-side Content Security Policy (CSP) violation reports for inline script execution on pages rendered by the plugin.

Monitoring Recommendations

Enable WordPress audit logging to capture administrative actions, user creation, and plugin or theme modifications in near real time.
Forward web server, WAF, and WordPress audit logs to a centralized SIEM or data lake for correlation across requests, sessions, and administrative events.
Alert on first-seen referrers and User-Agent strings hitting plugin endpoints, particularly from anonymous sources.

How to Mitigate CVE-2026-40720

Immediate Actions Required

Upgrade Royal Elementor Addons Pro to version 1.7.1041 or later on every WordPress instance where the plugin is installed.
Audit WordPress administrator and editor accounts and revoke any unrecognized users created since the plugin was deployed.
Force a password reset and invalidate active sessions for all privileged WordPress users by rotating authentication keys and salts in wp-config.php.
Review recently modified plugin, theme, and uploads directory files for injected JavaScript or PHP backdoors.

Patch Information

The vendor addressed the issue in Royal Elementor Addons Pro version 1.7.1041. Refer to the Patchstack Vulnerability Report for the authoritative fixed-version reference. Apply the update through the WordPress plugin manager or by deploying the patched release manually.

Workarounds

Temporarily deactivate the wpr-addons-pro plugin until the patched version can be installed and validated.
Deploy a WAF rule that blocks requests to plugin endpoints containing script tags, event handler attributes, or javascript: URIs.
Enforce a strict Content Security Policy that disallows inline scripts and restricts script sources to trusted origins, reducing the impact of injected payloads.

bash

# Example WAF rule (ModSecurity) blocking common XSS payloads to the plugin path
SecRule REQUEST_URI "@contains /wp-content/plugins/wpr-addons-pro/" \
  "chain,id:1040720,phase:2,deny,status:403,log,msg:'CVE-2026-40720 XSS attempt'"
  SecRule ARGS|REQUEST_HEADERS|QUERY_STRING "@rx (?i)(<script|onerror=|onload=|javascript:)" "t:urlDecodeUni,t:htmlEntityDecode"