Exploit discussion active in current signal (1 latest mentions)
Recommended action window: High priority (within 72h)
NVD description
The Royal Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'button_text' parameter in all versions up to, and including, 1.7.1049 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Priority
LOW
Exploitation
NONE
PoC
YES
Patch
NONE
Momentum
STABLE
| Date | Total | Labels |
|---|
| 2026-04-04 | 2 | Disclosure2 |
| 2026-04-10 | 1 | PoC1 |
CVE-2026-0664 The Royal Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'button_text' parameter in all versions up to, and including, 1… https://www.cve.org/CVERecord?id=CVE-2026-0664
Post summary
The Royal Addons for Elementor plugin is vulnerable to Stored XSS via the 'button_text' parameter (CVE‑2026‑0664). The post does not provide a PoC, exploit tool, or patch information.
https://atomicedge.io/cve-proof/cve-2026-0664-royal-elementor-addons-version-1-7-1049-medium-vulnerability-proof-of-concept CVE-2026-0664 #WordPress plugin #vulnerability royal-elementor-addons #cybersecurity #wordpressfirewall #wordpresssecurity #hacking #wpsecurity #atomicedge
Post summary
The post shares a URL to a proof‑of‑concept for CVE-2026-0664, but does not provide an exploit tool, evidence of active exploitation, patch info, or detailed technical description.
🚨 CYBERDUDEBIVASH SENTINEL APEX ALERT 🚨 Threat: CVE-2026-0664 - Royal Elementor Addons <= 1.7.1049 - Authenticated (Contributor+) Stored Cross-Site Scripting via REST API Meta Bypass Intel Report: https://ift.tt/bkVP7Oz
Post summary
A new CVE (CVE-2026-0664) has been disclosed, affecting Royal Elementor Add‑ons up to 1.7.1049, enabling authenticated contributors to perform stored XSS via a REST API meta bypass.