Public mode

No access to your tenant or devices. Every item links to its source. What this means

CVE-2026-13407

Royal Elementor Addons < 1.7.1067 - Unauthenticated Stored HTML Injection in Form Notification Emails

CVSS 3.1 6.1 MEDIUMCheck source for fixed versionsKEV status unknown

Original advisory

cve-program · CVE-2026-13407

Published

The Royal Elementor Addons WordPress plugin before 1.7.1067 does not properly sanitize and escape values submitted through its form widget before including them in the body of administrator notification emails, allowing unauthenticated attackers to inject arbitrary HTML into emails sent to the site administrator on form submission.

Read the publisher's advisory

Affected versions, risk and source history

cve-program · CVE-2026-13407

Published

Royal Addons for Elementor

https://wordpress.org/plugins

Publisher's version information

Shown as published. These rules are not interpreted as NuGet package version ranges.

{
                    "vendor": "Unknown",
                    "product": "Royal Addons for Elementor",
                    "versions": [
                        {
                            "status": "affected",
                            "versionType": "semver",
                            "version": "0",
                            "lessThan": "1.7.1067"
                        }
                    ],
                    "defaultStatus": "unaffected",
                    "collectionURL": "https://wordpress.org/plugins"
                }

Original source record · Cite this exact observation · Complete original publisher JSON