CVE-2026-4803: Royal Elementor Addons XSS Vulnerability

CVE-2026-4803 Overview

CVE-2026-4803 is a Stored Cross-Site Scripting (XSS) vulnerability in the Royal Elementor Addons plugin for WordPress. The flaw affects all versions up to and including 1.7.1056. Attackers exploit the status parameter in the wpr_update_form_action_meta AJAX action to inject arbitrary web scripts. The vulnerability stems from insufficient input sanitization and output escaping, compounded by a publicly leaked nonce that exposes the AJAX handler to unauthenticated requests. Injected scripts execute in the browser of any user who visits an affected page, enabling session theft, content manipulation, and forced redirects. The issue is tracked under CWE-79.

Critical Impact

Unauthenticated attackers can inject persistent JavaScript into WordPress sites running Royal Elementor Addons, executing arbitrary scripts in every visitor's browser session.

Affected Products

• Royal Elementor Addons plugin for WordPress (all versions through 1.7.1056)
• WordPress sites using the plugin's forms module (wpr-actions-status.php)
• WordPress installations exposing the wpr_update_form_action_meta AJAX endpoint

Discovery Timeline

• 2026-05-05 - CVE-2026-4803 published to NVD
• 2026-05-05 - Last updated in NVD database

Technical Details for CVE-2026-4803

Vulnerability Analysis

The vulnerability resides in the forms module of the Royal Elementor Addons plugin, specifically in classes/modules/forms/wpr-actions-status.php. The wpr_update_form_action_meta AJAX action accepts a status parameter from the request and writes it to persistent storage without applying sufficient sanitization. When the stored value is later rendered in pages or admin views, it is not properly output-escaped, allowing injected HTML and JavaScript to execute in the browser context of viewers.

Unauthenticated exploitation is possible because the nonce protecting the AJAX handler is publicly exposed on the front end. Attackers can harvest the nonce from a public page and submit forged requests that pass capability and nonce checks. The attack scope is changed because injected scripts execute under the origin of the WordPress site, granting access to cookies, session data, and authenticated administrative actions when an admin views a poisoned page.

Root Cause

The root cause is a combination of two defects: missing input sanitization on the status parameter when it is persisted via the AJAX handler, and missing output escaping when the value is rendered. The leaked nonce removes the only remaining authorization barrier, converting an authenticated XSS into an unauthenticated one. See the WordPress Plugin Code Review at line 21 and line 73 for the affected logic.

Attack Vector

An unauthenticated remote attacker sends a crafted POST request to the WordPress admin-ajax.php endpoint with action=wpr_update_form_action_meta, the leaked nonce, and a status value containing JavaScript payloads. The malicious payload is stored in plugin metadata and is rendered to any user who subsequently visits the affected page. Because the action is reachable without credentials, no user interaction is required to plant the payload. Refer to the Wordfence Vulnerability Analysis for the full technical write-up.

Detection Methods for CVE-2026-4803

Indicators of Compromise

• POST requests to admin-ajax.php containing action=wpr_update_form_action_meta originating from external IP addresses without an authenticated session cookie.
• Plugin metadata or submission custom post type entries containing <script>, onerror=, javascript:, or encoded HTML payloads in the status field.
• Unexpected outbound JavaScript callbacks from rendered WordPress pages to attacker-controlled domains.
• Browser console errors or unexpected redirects on pages rendered by the Royal Elementor Addons forms module.

Detection Strategies

• Inspect web server access logs for repeated POST requests to wp-admin/admin-ajax.php with the wpr_update_form_action_meta action parameter.
• Scan the WordPress database for stored values in the plugin's submissions custom post type containing HTML tags or script-like content.
• Deploy WAF rules that flag admin-ajax.php requests where the status parameter contains angle brackets, event handlers, or javascript: URIs.

Monitoring Recommendations

• Monitor the royal-elementor-addons plugin version on all WordPress installations and alert on versions at or below 1.7.1056.
• Enable file integrity monitoring on the plugin directory under wp-content/plugins/royal-elementor-addons/.
• Track admin user sessions for anomalous activity following visits to public-facing form pages, including unexpected privilege changes or new admin accounts.

How to Mitigate CVE-2026-4803

Immediate Actions Required

• Update the Royal Elementor Addons plugin to the version released after 1.7.1056 containing the fix in changeset 3503219.
• Audit the WordPress database for previously injected payloads in plugin submission and meta tables and remove malicious entries.
• Rotate WordPress administrator credentials and invalidate active sessions if exploitation is suspected.
• Review user accounts for unauthorized additions or privilege escalations created through stolen admin sessions.

Patch Information

The vendor addressed the vulnerability in the patch published in WordPress Changeset 3503219. The fix introduces proper sanitization of the status parameter in the wpr_update_form_action_meta handler and applies output escaping when the stored value is rendered. Site administrators should update through the WordPress plugin manager or via WP-CLI.

Workarounds

• Temporarily disable the Royal Elementor Addons plugin until the patched version is installed.
• Block external POST requests to wp-admin/admin-ajax.php with action=wpr_update_form_action_meta at the WAF or reverse proxy layer.
• Restrict access to the WordPress admin AJAX endpoint by IP address where feasible.
• Apply a Content Security Policy (CSP) that disallows inline scripts to reduce the impact of stored XSS payloads.

# Update the plugin via WP-CLI once the patched version is available
wp plugin update royal-elementor-addons

# Verify the installed version is greater than 1.7.1056
wp plugin get royal-elementor-addons --field=version