CVE-2026-5428 affects Royal Addons for Elementor and is an authenticated Author+ stored cross site scripting vulnerability in image captions rendered by the Image Grid, Slider, and Carousel widget. In versions through 1.7.1056, render_post_thumbnail() applies wp_kses_post() to data that is placed in an HTML attribute instead of using attribute-context escaping.
| CVE | CVE-2026-5428 |
| Plugin Version | Royal Addons for Elementor <= 1.7.1056, fixed in 1.7.1057 |
| All Time | 19 320 343 |
| Active installations | 600 000+ |
| Publicly Published | April 23, 2026 |
| Last Updated | April 24, 2026 |
| Researcher | Dmitrii Ignatyev |
| PoC | Yes |
| Exploit | No |
| Reference | https://www.cve.org/CVERecord?id=CVE-2026-5428 https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/royal-elementor-addons/royal-addons-for-elementor-171056-authenticated-author-stored-cross-site-scripting-via-image-caption-field |
| Plugin Security Certification by CleanTalk |  |
| Logo of the plugin |  |
PSC by CleantalkJoin the community of developers who prioritize security. Highlight your plugin in the WordPress catalog.
Timeline
| June 23, 2026 | Plugin testing and vulnerability detection in Royal Addons for Elementor were completed. |
| June 24, 2026 | The vulnerability was reported with PoC, description, and recommendations for remediation. |
| April 23, 2026 | CVE-2026-5428 was publicly published by Wordfence. |
Discovery of the Vulnerability
The Image Grid, Slider, and Carousel widget reads caption data from WordPress media attachments and uses it while building thumbnail markup. In render_post_thumbnail(), the caption reaches an HTML attribute after wp_kses_post() processing. That function is intended for limited post HTML and does not provide the escaping required for an attribute value.
An Author can save a caption that closes the intended attribute and adds an onload handler. When the affected image is rendered by the Royal Addons widget, the stored browser code executes for visitors who open the page or its preview.
Understanding of Stored XSS attacks
Stored cross site scripting persists attacker-controlled data in content or metadata and later renders it in another user’s browser. Context matters. Text that is acceptable as limited HTML can still be unsafe when inserted between quotes in an HTML attribute. The output must be escaped for the exact context where it is used.
Exploiting the Stored XSS Vulnerability
An Author can place the crafted value in an image caption and use that image in the affected Elementor widget. Reloading the page or opening its preview causes the browser to parse the injected event handler.
POC:
POC: 1. Log in with an Author or higher WordPress account. 2. Create or select an image in the Media Library. 3. Set the Caption field to the value below. x" onload="alert(1231231231)" y=" 4. Create a new post with the Royal Addons Image Grid, Slider, or Carousel widget. 5. Add the affected image to the widget. 6. Reload the page or open the preview.____
On a vulnerable version, the caption breaks out of the intended attribute and the onload handler executes under the site origin.
Recommendations for Improved Security
Site owners should update Royal Addons for Elementor to version 1.7.1057 or later and review image captions created by untrusted authors. Developers should use esc_attr() for every caption value placed in an HTML attribute and reserve wp_kses_post() for content intentionally rendered as limited HTML.
By addressing Stored XSS like CVE-2026-5428, WordPress site owners can reduce the risk from unsafe media metadata and protect visitors from browser-side compromise. Stay vigilant, stay secure.
#WordPressSecurity #StoredXSS #ElementorSecurity #WebsiteSafety #StayProtected #MediumVulnerability
Use CleanTalk solutions to improve the security of your website
