The Royal Addons for Elementor WordPress plugin versions prior to 1.7.1065 contain a stored XSS vulnerability (CWE-79) due to insufficient validation of a widget setting used in HTML output. This allows users with Contributor role or above to inject malicious HTML or JavaScript code that is stored and later executed in the context of other users viewing the affected content. No CVSS score or vendor advisory is currently available, and no patch or remediation information has been provided.

Successful exploitation could lead to persistent cross-site scripting attacks, enabling attackers with Contributor or higher privileges to execute arbitrary scripts in the browsers of other users. This may result in session hijacking, defacement, or other malicious actions within the context of the affected WordPress site. There is no evidence of known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict Contributor and higher roles from untrusted users and consider disabling or limiting the use of the vulnerable widget settings to reduce risk.