CVSS 3.1
6.6 mediumCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:LCVE-2026-13405
Medium (6.6). EPSS 0.4% chance of exploitation in the next 30 days.
The Royal Addons for Elementor WordPress plugin before 1.7.1066 does not correctly sanitise custom widget markup before writing it to a file that is later executed, allowing users with the manage_options capability (and, on WordPress Multisite, non-super subsite administrators who do not otherwise hold code-execution capabilities) to execute arbitrary PHP code.
Severity
- EPSS
- 0.4% chance of exploitation in the next 30 days; higher than 31% of CVEs (scores of 2026-11-01)
- CWE
- CWE-94
- Published
- Modified
- Record from
- the NVD, synced