The Royal Addons for Elementor plugin for WordPress suffers from a stored cross-site scripting vulnerability (CWE-79) in the Instagram Feed widget's 'instagram_follow_text' setting. This vulnerability allows authenticated users with Contributor-level privileges or higher to inject arbitrary web scripts into pages. These scripts execute whenever any user accesses the compromised page, potentially leading to session hijacking, defacement, or other script-based attacks. The issue arises from inadequate input sanitization and output escaping in all plugin versions up to 1.7.1056. The vulnerability has a CVSS 3.1 base score of 6.4, reflecting a medium severity impact with network attack vector, low attack complexity, and no user interaction required. No official fix or patch has been published by the vendor as of the latest information.

An attacker with Contributor-level or higher access can inject malicious scripts that execute in the context of users viewing the infected page. This can lead to information disclosure or manipulation of user sessions. The vulnerability does not affect availability but impacts confidentiality and integrity to a limited extent. There are no known active exploits reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict Contributor-level access to trusted users only and consider disabling or limiting use of the Instagram Feed widget's 'instagram_follow_text' setting. Monitor plugin updates from the vendor for a forthcoming patch.