Royal Elementor Addons XSS Vulnerability (CVE-2026-4803) Exposes WordPress Sites
The Royal Elementor Addons plugin for WordPress, in versions up to and including 1.7.1056, is vulnerable to Stored Cross-Site Scripting (XSS) via the status parameter. This critical flaw, tracked as CVE-2026-4803 and rated 7.2 (HIGH) by the National Vulnerability Database, stems from insufficient input sanitization and output escaping.
What makes this particularly dangerous is a publicly leaked nonce associated with the wpr_update_form_action_meta AJAX action. This allows unauthenticated attackers to exploit the vulnerability, injecting arbitrary web scripts into pages. These scripts then execute whenever a user accesses an infected page, potentially leading to session hijacking, credential theft, or further compromise.
For defenders, this is a straightforward, high-impact issue. Unauthenticated access to an XSS injection means a low bar for attackers. The National Vulnerability Database highlights that the core problem lies in lax validation combined with an exposed authentication bypass, a classic recipe for web application compromise.
What This Means For You
- If your organization uses the Royal Elementor Addons plugin on WordPress, you are directly exposed to unauthenticated Stored XSS. Immediately audit your WordPress installations to identify any sites running this plugin. Patch to the latest version available that addresses CVE-2026-4803 without delay. Assume compromise if you were running affected versions, and review web logs for suspicious activity targeting the `wpr_update_form_action_meta` AJAX action.
Related ATT&CK Techniques
🛡️ Detection Rules
3 rules · 6 SIEM formats3 detection rules auto-generated for this incident, mapped to MITRE ATT&CK. Sigma YAML is free — export to any SIEM format via the Intel Bot.
CVE-2026-4803: Royal Elementor Addons Stored XSS via wpr_update_form_action_meta AJAX
title: CVE-2026-4803: Royal Elementor Addons Stored XSS via wpr_update_form_action_meta AJAX
id: scw-2026-05-05-ai-1
status: experimental
level: high
description: |
Detects attempts to exploit CVE-2026-4803 by targeting the wpr_update_form_action_meta AJAX action in the Royal Elementor Addons plugin. This rule specifically looks for the 'action' parameter set to 'wpr_update_form_action_meta' and the presence of the 'status' parameter in the URI query, which is used for injecting malicious scripts.
author: SCW Feed Engine (AI-generated)
date: 2026-05-05
references:
- https://shimiscyberworld.com/posts/nvd-CVE-2026-4803/
tags:
- attack.initial_access
- attack.t1190
logsource:
category: webserver
detection:
selection:
cs-uri|contains:
- '/wp-admin/admin-ajax.php'
cs-uri-query|contains:
- 'action=wpr_update_form_action_meta'
cs-uri-query|contains:
- 'status='
selection_base:
cs-method:
- 'POST'
condition: selection AND selection_base
falsepositives:
- Legitimate administrative activity
Source: Shimi's Cyber World · License & reuse
Indicators of Compromise
| ID | Type | Indicator |
|---|---|---|
| CVE-2026-4803 | XSS | Royal Elementor Addons plugin for WordPress versions <= 1.7.1056 |
| CVE-2026-4803 | XSS | Vulnerable parameter: 'status' in wpr_update_form_action_meta AJAX action |
| CVE-2026-4803 | Auth Bypass | Publicly leaked nonce allowing unauthenticated access to AJAX handler |
Written by SCW Vulnerability Desk
Source & Attribution
| Source Platform | NVD |
| Channel | National Vulnerability Database |
| Published | May 05, 2026 at 07:16 UTC |
This content was AI-rewritten and enriched by Shimi's Cyber World based on the original source. All intellectual property rights remain with the original author.
Believe this infringes your rights? Submit a takedown request.
Related coverage
CVE-2026-7823: Critical Command Injection in Totolink A8000RU Routers
CVE-2026-7823 — A security flaw has been discovered in Totolink A8000RU 7.1cu.643_b20200521. Affected is the function setAppFilterCfg of the file /cgi-bin/cstecgi.cgi. The manipulation of the...
CVE-2026-7822 — Itsourcecode Courier Management System SQL Injection
CVE-2026-7822 — A vulnerability was identified in itsourcecode Courier Management System 1.0. This impacts an unknown function of the file /print_pdets.php. The manipulation of the...
CVE-2026-7812: Remote Command Injection in 54yyyu code-mcp MCP Tool
CVE-2026-7812 — A vulnerability was found in 54yyyu code-mcp up to 4cfc4643541a110c906d93635b391bf7e357f4a8. The impacted element is the function git_operation of the file src/code_mcp/server.py of the...