CVE-2026-40720: Unauthenticated XSS in Royal Elementor Addons Pro < 1.7.1041

Technical summary

CVE-2026-40720 is a reflected or stored XSS vulnerability in Royal Elementor Addons Pro that allows unauthenticated attackers to execute arbitrary JavaScript in the context of a victim's browser. The vulnerability stems from improper input sanitization or output encoding in the plugin's handling of user-supplied data. The high CVSS 3.1 score of 7.1 reflects the network-accessible attack vector (AV:N), low complexity (AC:L), no authentication requirement (PR:N), and the need for user interaction (UI:R). The impact scope is changed (S:C), meaning the vulnerability can affect resources beyond the vulnerable component, with potential consequences including confidentiality loss, integrity compromise, and limited availability impact.

Business impact

Organizations running WordPress sites with Royal Elementor Addons Pro face risk of account compromise, data theft, and malware distribution through their own web properties. Attackers could redirect users to phishing pages, capture sensitive information submitted through forms, or inject malicious advertisements. Compromised websites damage customer trust, create liability exposure, and may trigger incident response and remediation costs. Sites in regulated industries (finance, healthcare, e-commerce) face additional compliance and reputational consequences.

Affected systems

Royal Elementor Addons Pro versions prior to 1.7.1041 are vulnerable. This affects WordPress installations using the plugin across all PHP versions and hosting environments that support the affected plugin versions. Administrators should verify their current plugin version immediately, as the vulnerability does not require any special configuration to be exploitable—installation of the vulnerable version alone creates exposure.

Exploitability

The vulnerability is exploitable over the network without authentication, making it relatively straightforward for attackers to weaponize. User interaction is required (typically clicking a malicious link or visiting a compromised page), but this is a common social engineering vector. No special tools or technical sophistication are needed; standard XSS payloads can be crafted by entry-level attackers. The practical exploitability is moderate-to-high given the widespread use of Elementor in WordPress ecosystems and the ease of distribution via malicious links or referral traffic.

Remediation

Update Royal Elementor Addons Pro to version 1.7.1041 or later immediately. This is a straightforward remediation path. Additionally, conduct a security audit of your WordPress environment: review user account activity logs for suspicious login patterns, audit plugin and theme configurations, and consider implementing Web Application Firewall (WAF) rules to block common XSS payloads as a temporary mitigation layer pending patch deployment.

Patch guidance

Access the WordPress admin dashboard, navigate to Plugins, locate Royal Elementor Addons Pro, and use the 'Update' button to upgrade to version 1.7.1041 or the latest available version. Verify against the vendor's official release notes and changelog to confirm the update includes this XSS fix. Test the update on a staging environment first if feasible to ensure compatibility with your site's other plugins, themes, and custom code. After patching, clear any caching layers (browser cache, CDN cache) to ensure users receive the patched version.

Detection guidance

Monitor web server access logs and WAF logs for suspicious patterns including: XSS payloads in query strings or POST data (keywords: <script>, javascript:, onerror=, onload=), unusual referrer headers, and requests to admin or plugin-related paths from untrusted sources. Implement Content Security Policy (CSP) headers to restrict inline script execution and reduce XSS impact. Review WordPress security logs via plugins like Wordfence or Sucuri for unauthorized access attempts or post/page modifications. Monitor for unexpected JavaScript inclusions in page source code or signs of website defacement.

Why prioritize this

This vulnerability merits immediate patching due to its high CVSS score (7.1), unauthenticated attack surface, and widespread WordPress deployment footprint. The plugin is popular among content creators and agencies, increasing the number of exposed sites. XSS vulnerabilities frequently serve as a beachhead for credential theft, malware injection, and further compromise, making this a critical control point. The ease of exploitation and low attack complexity accelerate the timeline to weaponization.

Risk score, explained

The CVSS 3.1 score of 7.1 (HIGH) reflects five key factors: (1) Network accessibility (AV:N) enables remote exploitation from any internet-connected attacker; (2) Low attack complexity (AC:L) means no special preconditions or authentication; (3) No privileges required (PR:N) removes any authentication or authorization barrier; (4) User interaction required (UI:R) moderately reduces exploitability but remains a standard social engineering vector; (5) Changed scope (S:C) means impacts extend beyond the vulnerable plugin to the broader web application and user sessions. Collectively, these factors place the vulnerability in the HIGH severity band, warranting rapid remediation.

Frequently asked questions