CVE-2026-13405CWE-94code-injection

CVE-2026-13405

Medium · published August 20, 2026

CVSS v3.1
6.6
EPSS
0%
Percentile
30.6
In the wild
Unconfirmed
What it is

The Royal Addons for Elementor WordPress plugin before 1.7.1066 does not correctly sanitise custom widget markup before writing it to a file that is later executed, allowing users with the manage_options capability (and, on WordPress Multisite, non-super subsite administrators who do not otherwise hold code-execution capabilities) to execute arbitrary PHP code.

The record
Technical detail
CVSS v3.1
6.6 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:L
CVSS v4.0
Not supplied
EPSS
0.00378 · 30.6th percentile
Weakness
CWE-94 · Improper Control of Generation of Code ('Code Injection')
Published
2026-08-20T10:16Z
References (1)
https://wpscan.com/vulnerability/247be7fc-a49f-429e-875d-8649510c42b5/ · [email protected]
EPSS history
Timeline
  • 20 AUG 06:00Z
    Royal Elementor Addons < 1.7.1066 - Admin+ Remote Code Execution via Widget Builder
    cvelistv5