CVE-2026-4803
Published: 05 May 2026
Summary
CVE-2026-4803 is a high-severity Cross-site Scripting (CWE-79) vulnerability in Wordpress (inferred from references). Its CVSS base score is 7.2 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 41.8th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-15 (Information Output Filtering).
Deeper analysis
CVE-2026-4803 is a stored cross-site scripting (XSS) vulnerability in the Royal Elementor Addons plugin for WordPress, affecting all versions up to and including 1.7.1056. The flaw exists in the wpr_update_form_action_meta AJAX action, specifically via the 'status' parameter, due to insufficient input sanitization and output escaping. Additionally, a publicly leaked nonce enables unauthenticated access to the AJAX handler, allowing attackers to inject arbitrary web scripts into pages. The vulnerability is rated with a CVSS v3.1 base score of 7.2 (AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N) and is associated with CWE-79 (Cross-site Scripting).
Unauthenticated attackers can exploit this vulnerability remotely over the network with low complexity and no user interaction required. By sending crafted requests to the vulnerable AJAX endpoint, they can inject malicious scripts into form-related pages or submissions. These scripts execute in the context of any user, including administrators, who subsequently accesses the affected page, potentially leading to session hijacking, data theft, or further compromise of the WordPress site.
References provided include source code locations in the plugin's trac repository, such as wpr-actions-status.php (lines 21 and 73), wpr-submissions-cpt.php (line 23), and plugin.php (line 613), highlighting the vulnerable code paths. A specific changeset (3503219) in wpr-actions-status.php indicates a code modification, likely implementing a patch to address the issue. Security practitioners should update to a version beyond 1.7.1056 and review sites using this plugin for injected content.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-27185
Vulnerability details
The Royal Elementor Addons plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'status' parameter in the wpr_update_form_action_meta AJAX action in all versions up to, and including, 1.7.1056. This is due to insufficient input sanitization and output escaping,…
more
combined with a publicly leaked nonce that allows unauthenticated access to the AJAX handler. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Stored XSS in public-facing WordPress plugin directly enables remote exploitation of the application (T1190), arbitrary JavaScript execution via injected scripts (T1059.007), and session hijacking/data theft in the browser context (T1185).
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly requires validation of the 'status' parameter in the wpr_update_form_action_meta handler to block malicious script injection before storage.
Mandates output filtering/escaping on form-related pages so that attacker-supplied scripts cannot execute when rendered to users.
Enforces proper access control on the AJAX endpoint so that a publicly leaked nonce cannot grant unauthenticated attackers the ability to store XSS payloads.