The Royal Elementor Addons and Templates plugin for WordPress suffers from a stored XSS vulnerability (CWE-79) in its Form Builder widget due to improper neutralization of user-supplied input. Authenticated attackers with contributor or higher privileges can inject arbitrary JavaScript that executes in the context of users visiting the compromised pages. This vulnerability affects all versions up to 1.3.974. The CVSS 3.1 vector indicates network attack vector, low attack complexity, privileges required at low level, user interaction required, and scope changed, with limited confidentiality and integrity impact but no availability impact.

An attacker with contributor-level access or higher can inject persistent malicious scripts into pages via the Form Builder widget. These scripts execute in the browsers of users who visit the injected pages, potentially leading to session hijacking, unauthorized actions, or data theft limited to the scope of the affected site. The impact is limited to confidentiality and integrity with no availability impact. There is no evidence of known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict contributor-level access to trusted users only and consider disabling or limiting use of the Form Builder widget. Monitor for plugin updates from wproyal and apply them promptly once released.