CVE-2026-5428 is a stored cross-site scripting vulnerability in the Royal Addons for Elementor – Addons and Templates Kit for Elementor WordPress plugin. The vulnerability exists due to insufficient output escaping in the render_post_thumbnail() function, where wp_kses_post() is incorrectly used instead of esc_attr() for the alt attribute context. This allows authenticated attackers with Author-level privileges or higher to inject arbitrary web scripts via image captions in the Image Grid/Slider/Carousel widget. These scripts execute whenever a user accesses a page containing the malicious image, potentially compromising user interactions and data integrity.

An attacker with Author-level access or higher can inject persistent malicious scripts into image captions, which execute in the context of any user viewing the affected page. This can lead to unauthorized actions, data theft, or session hijacking within the scope of the affected site. The vulnerability does not allow unauthenticated exploitation and does not directly impact availability.

No official patch or remediation guidance is currently available from the vendor. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is released, restrict Author-level access to trusted users only and consider disabling the affected Image Grid/Slider/Carousel widget if possible to reduce exposure.