CVE-2026-27421 — WProyal Royal Elementor Addons Cross-Site Scripting (XSS)

title: CVE-2026-27421 - Royal Elementor Addons Stored XSS Attempt
id: scw-2026-05-07-ai-1
status: experimental
level: high
description: |
  This rule detects attempts to exploit CVE-2026-27421, a Stored Cross-Site Scripting (XSS) vulnerability in the Royal Elementor Addons plugin for WordPress. The detection focuses on specific URL paths and query parameters commonly associated with the plugin's AJAX endpoint, looking for patterns indicative of an XSS payload being injected, particularly within the 'settings' parameter which is often used for storing malicious scripts. This targets the initial access vector via a web application vulnerability.
author: SCW Feed Engine (AI-generated)
date: 2026-05-07
references:
  - https://shimiscyberworld.com/posts/nvd-CVE-2026-27421/
tags:
  - attack.initial_access
  - attack.t1190
logsource:
    category: webserver
detection:
  selection:
      cs-uri|contains:
          - '/wp-content/plugins/royal-elementor-addon/'
      cs-uri-query|contains:
          - 'elementor_widget_type=royal-elementor-addons'
      cs-uri-query|contains:
          - 'action=elementor_ajax'
      cs-uri-query|contains:
          - 'nonce='
      cs-uri-query|contains:
          - 'settings=' # This parameter is often used to store malicious scripts
      cs-uri-query|contains:
          - '<script>'
      cs-uri-query|contains:
          - 'alert(' # Common XSS payload indicator
      cs-method|exact:
          - 'POST'
  condition: selection
falsepositives:
  - Legitimate administrative activity

Source: Shimi's Cyber World · License & reuse