Quick Look: CVE-2026-4803 — Unauthenticated Stored XSS in Royal Elementor Addons via Leaked Nonce

Introduction

A publicly leaked nonce in the Royal Elementor Addons plugin for WordPress has turned what should be a protected AJAX endpoint into an open door for unauthenticated stored cross-site scripting. The plugin has over 600,000 active installations, so CVE-2026-4803 is a meaningful risk across a large swath of the WordPress ecosystem.

Royal Elementor Addons, developed by WP Royal, is a widely used extension for the Elementor page builder that adds widgets, templates, and form handling. Its popularity among WordPress site builders makes it a frequent target for security researchers and, consequently, for attackers.

Technical Information

The vulnerability is in the wpr_update_form_action_meta AJAX handler, located in wpr-actions-status.php. Two flaws combine to cause it: a publicly exposed nonce that defeats authentication controls, and insufficient sanitization of user-supplied input before it is stored and rendered.

Nonce Exposure and Authentication Bypass

The AJAX handler is registered through the wp_ajax_nopriv hook, so WordPress routes requests from unauthenticated users to this endpoint. The code does check a nonce, but the nonce value (WprConfig.nonce) is embedded in frontend JavaScript on any page that loads Royal Addons widgets. Any visitor can pull a valid nonce from the page source, which makes the nonce check meaningless as access control.

The endpoint also has no capability check or ownership verification. There is no call to current_user_can() and no equivalent authorization gate. The nonce was the only barrier, and it was publicly available.

Payload Storage and Rendering

With the nonce in hand, an attacker can call the wpr_update_form_action_meta AJAX action with a crafted payload in the status parameter. The vulnerable code path passes this user-controlled input to update_post_meta without adequate sanitization or escaping, and the malicious data goes straight into the WordPress database as post metadata. When the frontend later renders that metadata, it outputs it without proper escaping, which produces stored cross-site scripting.

Attack Flow

The exploit chain has five steps:

1. The attacker visits any page on the target WordPress site that loads a Royal Elementor Addons widget.
2. The attacker extracts the WprConfig.nonce value from the page's JavaScript source.
3. Using this nonce, the attacker sends a crafted POST request to wp-admin/admin-ajax.php with the action set to wpr_update_form_action_meta and a malicious JavaScript payload in the status parameter.
4. The server validates the nonce, which passes because the nonce is legitimate. It performs no capability or ownership checks and stores the payload via update_post_meta.
5. When any user, including administrators, visits the page where this metadata is rendered, the injected script executes in their browser.

No step in the chain requires authentication. The CVSS score of 7.2 reflects the unauthenticated attack vector and the fact that the stored XSS payload persists.

Patch Mechanics

The patched version (1.7.1057 and later) adds strict server-side validation. The updated code requires a submission secret generated per post and checks it with hash_equals before allowing any metadata update, which effectively blocks unauthenticated tampering.

Affected Systems and Versions

The vulnerability affects the Royal Addons for Elementor (also known as Royal Elementor Addons) WordPress plugin in all versions up to and including 1.7.1056. Version 1.7.1057 introduced the fix, and version 1.7.1058 also contains the security fixes.

Any WordPress site running an affected version of the plugin with form modules active is vulnerable, because the nonce is exposed on any page that loads Royal Addons widgets.

Vendor Security History

WP Royal has faced a cluster of security disclosures in a short period. These are the recent vulnerabilities in the Royal Elementor Addons ecosystem:

Two problems recur across these disclosures: authorization bypass and insufficient input sanitization. The vendor has been responsive in releasing patches, but the same vulnerability classes keep appearing, which suggests systemic security problems in the codebase.

References

• Wordfence Threat Intel: CVE-2026-4803
• WordPress Plugin Trac: wpr-actions-status.php (Line 21)
• WordPress Plugin Trac: wpr-actions-status.php (Line 73)
• WordPress Plugin Trac: wpr-submissions-cpt.php (Line 23)
• WordPress Plugin Trac: plugin.php (Line 613)
• WordPress Plugin Trac: Changeset 3503219
• GitHub Advisory: GHSA-9xvg-5x4x-v2hq
• WordPress Plugin Directory: Royal Elementor Addons
• Wordfence: Missing Authorization in Royal Addons for Elementor (CVE-2026-4024)
• Patchstack: XSS in Royal Elementor Addons