The Royal Addons for Elementor plugin for WordPress suffers from a stored XSS vulnerability due to insufficient input sanitization and output escaping in the Instagram Feed widget's 'instagram_follow_text' setting. Authenticated attackers with Contributor-level privileges or above can exploit this flaw to inject arbitrary web scripts into pages. Execution of these scripts occurs when users access the compromised pages. Exploitation depends on the Instagram Feed widget being configured with a valid Instagram access token by an administrator. The vulnerability is present in all versions up to 1.7.1056. No vendor advisory or patch information is currently provided.

Successful exploitation allows an authenticated user with Contributor-level access or higher to inject malicious scripts that execute in the context of the affected website. This can lead to limited confidentiality and integrity impacts, such as session hijacking or defacement, but does not affect availability. The vulnerability requires prior widget configuration by an administrator, which limits the attack surface. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict Contributor-level access to trusted users only and monitor for suspicious activity related to the Instagram Feed widget configuration. Consider disabling or removing the Instagram Feed widget if it is not essential.