CVE-2026-13407
Royal Elementor Addons < 1.7.1067 - Unauthenticated Stored HTML Injection in Form Notification Emails
- State
- Published
- Severity
- 6.1 Medium
- Published
- Sep 16, 2026
- Updated
- Sep 16, 2026
- Reserved
- Jun 26, 2026
Description
The Royal Elementor Addons WordPress plugin before 1.7.1067 does not properly sanitize and escape values submitted through its form widget before including them in the body of administrator notification emails, allowing unauthenticated attackers to inject arbitrary HTML into emails sent to the site administrator on form submission.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 3.1 | 6.1 Medium | CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N | WPScan |
Weaknesses
- CWE-116 Improper Encoding or Escaping of Output
Affected Products
| Product | Versions |
|---|---|
Royal Addons for ElementorUnknown |
|
References
- https://wpscan.com/vulnerability/b6bb29de-7d61-4a83-9ee1-0915ad2bda34/exploitvdb-entrytechnical-description
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.