CVE-2026-40720: WordPress Royal Elementor Addons Pro plugin < 1.7.1041 - Cross Site Scripting (XSS) vulnerability

Synopsis

This is a reflected or stored cross-site scripting (XSS) vulnerability in the Royal Elementor Addons Pro WordPress plugin, affecting all versions below 1.7.1041. The flaw is reachable over the network without any authentication, but requires a victim to interact with a malicious link or page for the attack to succeed. Successful exploitation lets an attacker inject and run arbitrary JavaScript in the victim's browser, enabling session hijacking, credential theft, or unauthorized actions taken on the victim's behalf. A patched-image rebuild at version 1.7.1041 is available on HarborGuard for affected environments.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must be able to reach the target WordPress site over the network; no local or physical access is needed.

• AuthenticationNot required

  No account or credentials are needed; the attack can be launched by any unauthenticated party.

• Victim interactionRequired

  A victim must take an action such as clicking a crafted link or visiting a malicious page for the injected script to execute in their browser.

• Attack complexityDetail

  The exploit is reliable and condition-free; no race conditions or special environmental factors need to align for it to succeed.

Blast Radius

• Reads session cookies or authentication tokens from the victim's browser, enabling account takeover.
• Exfiltrates form input and credentials entered by the victim on the affected WordPress site.
• Performs unauthorized actions within the application on the victim's behalf, such as changing account settings or submitting data.
• Injects visible content or redirects into the page, enabling phishing or further social-engineering attacks against the victim.