CVE-2026-19226

Royal Elementor Addons < 1.7.1066 - Contributor+ Stored XSS via Image Accordion Widget Effect Settings

The Royal Addons for Elementor WordPress plugin before 1.7.1066 does not validate some widget settings before outputting them inside an HTML attribute, which could allow users with the Contributor role and above to perform Stored Cross-Site Scripting attacks.

We have discovered 69,726 live websites that are affected by CVE-2026-19226.

Run a Free Instant Scan



Affected Software

Product  Royal Elementor Addons
Category Wordpress Plugins
Vulnerable Domains69,726 live websites (100% of Royal Elementor Addons install base)
Vulnerable Versions
  • from 0 through 1.7.1066
Vulnerable Versions Count156 versions ( 99% of all versions)


Common Weakness Enumeration

CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')



Details

  • Published - Aug 26, 2026
  • Updated - Aug 26, 2026

Credits

  • Erwan LR (WPScan) (finder)
  • WPScan (coordinator)

Website Distribution by Country

Number of websites using CVE-2026-19226
United States14,914 websites


Germany7,439 websites
France5,900 websites
Brazil5,634 websites
India3,892 websites
Italy3,691 websites
GB2,399 websites
Spain2,333 websites
Cyprus2,289 websites
Poland1,427 websites

Website Distribution by TLD

Number of websites using CVE-2026-19226
.com27,659 websites
.com.br5,148 websites
.de4,244 websites
.org3,017 websites
.fr2,868 websites
.it2,702 websites
.net1,292 websites
.co.uk1,206 websites
.pl1,098 websites
.nl1,032 websites

Vulnerable Versions

Vulnerable versions are highlighted in red

Websites affected by CVE-2026-19226

Top websites that are affected by CVE-2026-19226. Please click on the "Contact us" link to get more information.
DomainCountryRankContacts
*********.com United States*,***
*******.**.uk United States*,***
*********************.fr France**,***
*********.gr Greece**,***
******.com United States**,***
********.no Norway**,***
******.cc Malaysia**,***
*******************.org Mexico**,***
****************.***.ar Argentina**,***
*********.net Germany**,***
See full domain list

FAQ

CVE-2026-19226 is Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in Royal Elementor Addons
A total of 69,726 websites have been identified as vulnerable to CVE-2026-19226, based on global website indexing conducted by WebTechSurvey.
The Royal Elementor Addons is affected by the CVE-2026-19226 vulnerability.
Royal Elementor Addons versions up to 1.7.1066 are vulnerable to CVE-2026-19226.
CVE-2026-19226 is resolved in version 1.7.1066 of Royal Elementor Addons.