CVE-2026-40720 identifies a cross-site scripting vulnerability in WP Royal, a versatile and intuitive page builder extension for WordPress. The vulnerability affects all versions up to and including 1.7.1041. The Bundesamt für Sicherheit in der Informationstechnik published this advisory but did not provide a CVSS score or detailed technical exploitation information. No known exploits are reported in the wild. No patch or remediation details are provided in the source data.

The vulnerability allows cross-site scripting attacks, which could enable attackers to execute arbitrary scripts in the context of affected websites using WP Royal versions up to 1.7.1041. This may lead to session hijacking, defacement, or other script-based attacks depending on the context of exploitation. No further impact details or exploitation reports are available.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no patch or fix information is provided, users should monitor official channels from the Bundesamt für Sicherheit in der Informationstechnik or the WP Royal plugin maintainers for updates. Until a fix is available, consider disabling or restricting use of the affected plugin versions to mitigate risk.