CVE-2026-5162Disclosure

LOWCVSS 6.4 · MEDIUM

Exploit discussion active in current signal (3 latest mentions)

Immediate actions

Hunt for exploitation attempts and persistence artifacts
Increase monitoring for publicly documented tradecraft
Track advisory updates for patch or workaround availability

Recommended action window: High priority (within 72h)

NVD description

The Royal Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Instagram Feed widget's 'instagram_follow_text' setting in all versions up to, and including, 1.7.1056 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

Back to dashboard

1.5/ 10 priority

Sources & remediation

Other references

Weakness type (CWE)

CWE-79

Priority

LOW

Exploitation

NONE

PoC

YES

Patch

NONE

Momentum

NONE

Threat summary

Public PoC is present in monitored signal
3 mentions across 1 observed day

What's happening

PoC mentioned or linked in 1 signal
Technical details provided in 2 signals
Disclosure: 2 classified signals
3 total mentions across 1 day

Deep dive

Activity timeline3 mentions / 1d

Signal classification2 categories

Disclosure

266.7%

PoC

133.3%

Referenced assets3 URLs

By indicator

Full discourse3 posts

Atomic Edge@atomicedgeWAF174d
PoC
https://atomicedge.io/cve-proof/cve-2026-5162-royal-elementor-addons-version-1-7-1056-medium-vulnerability-proof-of-concept CVE-2026-5162 #WordPress plugin #vulnerability royal-elementor-addons #cybersecurity #wordpressfirewall #wordpresssecurity #hacking #wpsecurity #atomicedge
Post summary
The post announces a proof‑of‑concept for CVE‑2026‑5162 affecting Royal Elementor Addons v1.7.1056, linking to the PoC, but lacks details on active exploitation, patches, or technical vulnerability specifics.
0000044
7 followersView on X
CVE@CVEnew174d
Disclosure
CVE-2026-5162 The Royal Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Instagram Feed widget's 'instagram_follow_text' setting in all … https://www.cve.org/CVERecord?id=CVE-2026-5162
Post summary
The text announces the discovery of CVE‑2026‑5162, providing technical details that it is a stored XSS flaw in the Royal Addons for Elementor WordPress plugin’s Instagram Feed widget, without mentioning PoCs, exploits, or patch information.
0000073
57.2K followersView on X
Vulmon Vulnerability Feed@VulmonFeeds174d
Disclosure
CVE-2026-5162 Stored Cross-Site Scripting in Royal Addons for Elementor Instagram Feed Widget https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-5162
Post summary
The post announces CVE‑2026‑5162, a stored XSS flaw in the Royal Addons Instagram Feed Widget, without providing PoC, exploit code, or remediation details.
0000060
4.0K followersView on X

Explore more

Back to dashboard