Signal is active with 2 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
The Royal Elementor Addons plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'status' parameter in the wpr_update_form_action_meta AJAX action in all versions up to, and including, 1.7.1056. This is due to insufficient input sanitization and output escaping, combined with a publicly leaked nonce that allows unauthenticated access to the AJAX handler. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
NONE
Momentum
NONE
⚡ New CVE Alert: CVE-2026-4803 📊 Severity: 7.2 🚨 Risk Level: High 🧩 Affects: Wordpress Reference: https://nvd.nist.gov/vuln/detail/CVE-2026-4803 #CVE-2026-4803 #CVE #High #Wordpress #CyberSecurity #InfoSec https://t.co/bAnRXEWrIs
Post summary
The tweet announces the new WordPress vulnerability CVE-2026‑4803 with a severity score of 7.2, but offers no further technical, exploitation, or mitigation details.
CVE-2026-4803 Stored Cross-Site Scripting in Royal Elementor Addons Plugin Versions Up ... https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-4803 Vulnerability Notification: https://alerts.vulmon.com/?utm_source=twitter&utm_medium=social&utm_campaign=2102281&utm_content=3
Post summary
The tweet announces CVE‑2026‑4803—a stored XSS in Royal Elementor Addons plugin—providing a link to vulnerability details but no PoC, exploit, or patch information.