The Royal Elementor Addons plugin for WordPress versions up to and including 1.7.1056 contains a stored cross-site scripting vulnerability (CVE-2026-5428) due to improper output escaping in the render_post_thumbnail() function. Specifically, the plugin uses wp_kses_post() instead of esc_attr() for sanitizing the alt attribute in image captions within the Image Grid/Slider/Carousel widget. This allows authenticated users with Author-level privileges or higher to inject arbitrary JavaScript code that executes when other users access pages displaying the malicious image. The vulnerability has a CVSS 3.1 base score of 6.4 (medium severity), with network attack vector, low attack complexity, and no user interaction required. No official fix or patch has been published by the vendor as of the provided data.

Successful exploitation allows an authenticated user with Author-level access or higher to inject persistent malicious scripts into image captions. These scripts execute in the context of any user viewing the affected pages, potentially leading to information disclosure or session hijacking. The impact is limited to confidentiality and integrity, with no availability impact reported. The vulnerability requires authenticated access and affects the WordPress plugin's image rendering functionality.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict Author-level access to trusted users only and consider disabling or avoiding use of the Image Grid/Slider/Carousel widget in the affected plugin. Monitor for updates from the vendor regarding patches or official mitigations.