The Royal Elementor Addons and Templates plugin for WordPress suffers from a stored cross-site scripting vulnerability (CWE-79) due to improper neutralization of user input in the Advanced Accordion widget's 'accordion_title_tag' attribute. This allows authenticated users with contributor-level permissions or higher to inject arbitrary JavaScript code that executes in the context of other users viewing the affected pages. The vulnerability affects all versions up to 1.3.971. The CVSS 3.1 base score is 6.4, reflecting network attack vector, low attack complexity, low privileges required, no user interaction, and impacts on confidentiality and integrity with no availability impact. There is no vendor advisory or patch link currently available, and no known exploitation in the wild has been reported.

Successful exploitation allows an authenticated contributor or higher to inject and execute arbitrary scripts in the context of other users visiting the affected pages. This can lead to unauthorized disclosure of information and modification of data within the affected site. There is no direct impact on availability. The vulnerability could be leveraged for session hijacking, defacement, or other malicious actions depending on the injected script.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a patch is available, restrict contributor-level access to trusted users only and consider disabling or avoiding use of the Advanced Accordion widget. Monitor official wproyal communications for updates or fixes addressing this vulnerability.