Signal is active with 3 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
The Royal Addons for Elementor WordPress plugin before 1.7.1066 does not correctly sanitise custom widget markup before writing it to a file that is later executed, allowing users with the manage_options capability (and, on WordPress Multisite, non-super subsite administrators who do not otherwise hold code-execution capabilities) to execute arbitrary PHP code.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
NONE
Momentum
NONE
CVE-2026-13405 The Royal Addons for Elementor WordPress plugin before 1.7.1066 does not correctly sanitise custom widget markup before writing it to a file that is later executed, … https://www.cve.org/CVERecord?id=CVE-2026-13405
Post summary
The post discloses that Royal Addons for Elementor before version 1.7.1066 fails to sanitize widget markup, leading to potential execution of malicious code.
🚨*CVE* CVE-2026-13405 The Royal Addons for Elementor WordPress plugin before 1.7.1066 does not correctly sanitise custom widget markup before writing it to a file that is later executed, … https://www.cve.org/CVERecord?id=CVE-2026-13405 ----- Traducción: CVE-2026-13405 The… https://infoflow.cloud`
Post summary
A new CVE (2026‑13405) has been disclosed for the Royal Addons for Elementor WordPress plugin, indicating that unsanitised widget markup can lead to file execution (RCE). No PoC, exploit, or patch information is provided.
CVE-2026-13405 Arbitrary PHP Code Execution in Royal Addons for Elementor WordPress Plugin https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-13405
Post summary
A new vulnerability (CVE-2026-13405) affecting Royal Addons for Elementor is announced, describing arbitrary PHP code execution; details are linked via the provided URL.