CVE-2026-13405

Royal Elementor Addons < 1.7.1066 - Admin+ Remote Code Execution via Widget Builder

The Royal Addons for Elementor WordPress plugin before 1.7.1066 does not correctly sanitise custom widget markup before writing it to a file that is later executed, allowing users with the manage_options capability (and, on WordPress Multisite, non-super subsite administrators who do not otherwise hold code-execution capabilities) to execute arbitrary PHP code.

We have discovered 69,726 live websites that are affected by CVE-2026-13405.

Run a Free Instant Scan



Affected Software

Product  Royal Elementor Addons
Category Wordpress Plugins
Vulnerable Domains69,726 live websites (100% of Royal Elementor Addons install base)
Vulnerable Versions
  • from 0 through 1.7.1066
Vulnerable Versions Count156 versions ( 99% of all versions)


Common Weakness Enumeration

CWE-94 Improper Control of Generation of Code ('Code Injection')



Details

  • Published - Aug 20, 2026
  • Updated - Aug 20, 2026

Credits

  • Muni Nitish Kumar Yaddala (finder)
  • WPScan (coordinator)

Website Distribution by Country

Number of websites using CVE-2026-13405
United States14,914 websites


Germany7,439 websites
France5,900 websites
Brazil5,634 websites
India3,892 websites
Italy3,691 websites
GB2,399 websites
Spain2,333 websites
Cyprus2,289 websites
Poland1,427 websites

Website Distribution by TLD

Number of websites using CVE-2026-13405
.com27,659 websites
.com.br5,148 websites
.de4,244 websites
.org3,017 websites
.fr2,868 websites
.it2,702 websites
.net1,292 websites
.co.uk1,206 websites
.pl1,098 websites
.nl1,032 websites

Vulnerable Versions

Vulnerable versions are highlighted in red

Websites affected by CVE-2026-13405

Top websites that are affected by CVE-2026-13405. Please click on the "Contact us" link to get more information.
DomainCountryRankContacts
*********.com United States*,***
*******.**.uk United States*,***
*********************.fr France**,***
*********.gr Greece**,***
******.com United States**,***
********.no Norway**,***
******.cc Malaysia**,***
*******************.org Mexico**,***
****************.***.ar Argentina**,***
*********.net Germany**,***
See full domain list

FAQ

CVE-2026-13405 is Improper Control of Generation of Code ('Code Injection') in Royal Elementor Addons
A total of 69,726 websites have been identified as vulnerable to CVE-2026-13405, based on global website indexing conducted by WebTechSurvey.
The Royal Elementor Addons is affected by the CVE-2026-13405 vulnerability.
Royal Elementor Addons versions up to 1.7.1066 are vulnerable to CVE-2026-13405.
CVE-2026-13405 is resolved in version 1.7.1066 of Royal Elementor Addons.