https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-06T05:46:54.392539+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/euvd-2026-352868 EUVD-2026-352868 2026-10-06T05:46:54.441084+00:00 EUVD-2026-352868 https://cve.radiocsirt.org/vuln/fkie_cve-2026-5428 fkie_cve-2026-5428 2026-10-06T05:46:54.441119+00:00

The Royal Elementor Addons plugin for WordPress is vulnerable to Stored Cross-Site Scripting via image captions in the Image Grid/Slider/Carousel widget in versions up to and including 1.7.1056. This is due to insufficient output escaping in the render_post_thumbnail() function, where wp_kses_post() is used instead of esc_attr() for the alt attribute context. This makes it possible for authenticated attackers, with Author-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses a page with the malicious image displayed in the media grid widget.

 https://cve.radiocsirt.org/vuln/ghsa-f4r3-xfjm-5x8p GHSA-f4r3-xfjm-5x8p 2026-10-06T05:46:54.441152+00:00

The Royal Elementor Addons plugin for WordPress is vulnerable to Stored Cross-Site Scripting via image captions in the Image Grid/Slider/Carousel widget in versions up to and including 1.7.1056. This is due to insufficient output escaping in the render_post_thumbnail() function, where wp_kses_post() is used instead of esc_attr() for the alt attribute context. This makes it possible for authenticated attackers, with Author-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses a page with the malicious image displayed in the media grid widget.