CVE-2026-107098

— UNSCORED

Published 2026-10-28 · Updated 2026-10-28

AI analysis for this CVE has not been generated yet. Raw NVD data is shown below.

NVD description

The Royal Addons for Elementor WordPress plugin before 1.7.1070 does not sanitise and escape one of its map widget's size settings before concatenating it into an HTML attribute, allowing users with the Contributor role or above to inject JavaScript that runs in the browser of any user who views the page, including an administrator reviewing a pending submission.

All references

https://wpscan.com/vulnerability/36a85589-3cf3-4e9c-85fd-e0896e92fc52/

Source data: NVD (nvd.nist.gov), public domain. Exploit-DB.ai adds local AI analysis for defensive use only.