CVE-2026-13407

MEDIUMCVSS 5.4

Description

The Royal Elementor Addons WordPress plugin before 1.7.1067 does not properly sanitize and escape values submitted through its form widget before including them in the body of administrator notification emails, allowing unauthenticated attackers to inject arbitrary HTML into emails sent to the site administrator on form submission.

Timeline

Published:September 16th, 2026 7:16 AM

Last modified:September 16th, 2026 8:25 PM

CVSS Scoring

CVSS v3: 5.4 (MEDIUM)

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N

Weaknesses (CWE)

CWE-116

References & Reports

Advisories, patches, and third-party reports

https://wpscan.com/vulnerability/b6bb29de-7d61-4a83-9ee1-0915ad2bda34/

Source: NIST NVD · Data may lag official sources by up to one minute