The Royal Addons for Elementor plugin suffers from a stored XSS vulnerability due to insufficient input sanitization and output escaping in the Instagram Feed widget's 'instagram_follow_text' setting. This allows authenticated users with Contributor or higher privileges to inject arbitrary web scripts that execute in the context of users viewing the compromised pages. Successful exploitation depends on the Instagram Feed widget being configured with a valid Instagram access token by an administrator. The vulnerability affects all versions up to 1.7.1056 and has a CVSS 3.1 base score of 6.4 (medium severity). No official patch or remediation guidance is currently available from the vendor.

An attacker with Contributor-level or higher access can inject persistent malicious scripts into pages via the vulnerable setting. These scripts execute in the browsers of users who visit the injected pages, potentially leading to session hijacking, defacement, or other client-side attacks. The vulnerability requires prior administrative configuration of the Instagram Feed widget, limiting the attack surface somewhat. There is no indication of known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict Contributor-level access to trusted users only and consider disabling or removing the Instagram Feed widget if it is not essential. Monitor for updates from the vendor regarding patches or official mitigations.