The Royal Elementor Addons and Templates plugin for WordPress suffers from a stored DOM-based Cross-Site Scripting vulnerability (CWE-79) in its Magazine Grid/Slider widget. This vulnerability is due to improper neutralization of user-supplied input during web page generation, specifically insufficient sanitization and escaping of attributes. Authenticated attackers with contributor-level permissions or higher can inject arbitrary web scripts that persist and execute in the context of users viewing the compromised pages. This can lead to partial confidentiality and integrity impacts as indicated by the CVSS vector (Confidentiality: Low, Integrity: Low, Availability: None). The vulnerability affects all versions up to 1.3.980. No patch or vendor advisory is currently available to confirm remediation status.

An attacker with contributor-level or higher access can inject persistent malicious scripts into pages via the vulnerable widget. These scripts execute in the browsers of users who view the infected pages, potentially leading to partial disclosure of information and unauthorized modification of content or user interface elements. There is no direct impact on system availability. The CVSS score of 6.4 reflects a medium severity with network attack vector, low attack complexity, and no user interaction required.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict contributor-level access to trusted users only and consider disabling or removing the vulnerable widget if feasible. Monitor official wproyal or WordPress plugin repositories for updates addressing this vulnerability.