Royal Addons for Elementor – Addons and Templates Kit for Elementor < 1.7.1053 - Authenticated (Contributor+) Stored Cross-Site Scripting

This exploitation research plan targets CVE-2026-27421, a Stored Cross-Site Scripting (XSS) vulnerability in the Royal Addons for Elementor plugin. The vulnerability allows Contributor-level users to inject malicious scripts into pages via unsanitized Mega Menu settings.

1. Vulnerability Summary

• Vulnerability: Stored Cross-Site Scripting (XSS)
• Location: admin/mega-menu.php (specifically the AJAX handler wpr_save_mega_menu_settings)
• Root Cause: The plugin registers AJAX actions for saving Mega Menu configurations but fails to adequately sanitize input parameters before storing them in post meta. Furthermore, these values are later rendered in the admin dashboard or frontend menus without proper output escaping (e.g., using esc_attr() or esc_html()).
• Privilege Level: Authenticated (Contributor+). While Mega Menus are typically an admin feature, the AJAX handlers and the underlying Custom Post Type (wpr_mega_menu) are often accessible or editable by lower-level users who have access to the Elementor editor.

2. Attack Vector Analysis

• Endpoint: /wp-admin/admin-ajax.php
• Action: wpr_save_mega_menu_settings
• Vulnerable Parameter(s): Settings associated with menu items, likely wpr_mm_custom_width or other text-based settings stored in the wpr-mega-menu-item meta.
• Preconditions:
  1. The plugin "Royal Addons for Elementor" is active.
  2. At least one WordPress Menu and Menu Item must exist.
  3. The attacker has a Contributor-level account.

3. Code Flow

1. Entry Point: An AJAX POST request is sent to admin-ajax.php with the action wpr_save_mega_menu_settings.
2. Hook Registration: In admin/mega-menu.php, the action is registered:
   add_action( 'wp_ajax_wpr_save_mega_menu_settings', 'wpr_save_mega_menu_settings' );
3. Vulnerable Handler: The (inferred) wpr_save_mega_menu_settings function retrieves the item_id and settings from $_POST.
4. Insecure Storage: The handler uses update_post_meta($item_id, 'wpr_mm_settings', $settings) (or similar) without sanitizing the values within the $settings array.
5. Sink: When the admin menu or the frontend page renders the menu, the function render_settings_popup (or its frontend equivalent) retrieves the meta and echoes it.
   • Example Sink in admin/mega-menu.php: The render_settings_popup function renders HTML for the settings. If any previously saved setting is echoed back into an attribute or text node without escaping, the XSS triggers.

4. Nonce Acquisition Strategy

The AJAX actions in admin/mega-menu.php require a nonce verified against the action string 'wpr-mega-menu-js'.

1. Identify the Source: The nonce is enqueued via enqueue_scripts in admin/mega-menu.php.
2. Localization Key: Based on plugin patterns, the nonce is likely localized in a global JavaScript object. We will search for WPRMegaMenu or WprConfig.
3. Acquisition Steps:
   • Create a post/page and open the Elementor editor (accessible to Contributors).
   • Alternatively, navigate to any admin page where Royal Addons scripts are enqueued.
   • Execute the following in the browser console:
     browser_eval("window.WPRMegaMenu?.nonce || window.WprConfig?.nonce")
4. Bypass Note: If wpr_save_mega_menu_settings lacks a current_user_can('manage_options') check (unlike wpr_create_mega_menu_template), a Contributor can exploit it using this nonce.

5. Exploitation Strategy

1. Target Identification: Identify a valid menu_item_id. This can be done via wp_cli or by inspecting the Navigation Menus page.
2. Craft Payload: Use a payload designed to break out of an HTML attribute:
   "><script>alert(document.domain)</script>
3. HTTP Request (using http_request tool):
   • URL: https://<target>/wp-admin/admin-ajax.php
   • Method: POST
   • Headers: Content-Type: application/x-www-form-urlencoded
   • Body:

     action=wpr_save_mega_menu_settings&
     nonce=<NONCE>&
     item_id=<ITEM_ID>&
     settings[wpr_mm_custom_width]=600"><script>alert(1)</script>&
     settings[wpr_mm_enabled]=true
     

     (Note: Parameter structure settings[] is inferred based on standard Royal Addons AJAX patterns).

6. Test Data Setup

1. Create Menu: wp menu create "Test Menu"
2. Add Item: wp menu item add-post test-menu 1 (where 1 is a valid post ID).
3. Identify ID: Get the Menu Item ID (this is a post of type nav_menu_item):
   wp post list --post_type=nav_menu_item --format=ids
4. Create Attacker: wp user create attacker attacker@example.com --role=contributor --user_pass=password

7. Expected Results

• The AJAX response should return a success status (e.g., {"success": true}).
• The malicious payload should be stored in the database.
• When an administrator visits the Appearance > Menus page, the render_settings_popup function will execute, rendering the injected script.

8. Verification Steps

1. Database Check: Verify the payload is stored:
   wp post meta get <ITEM_ID> wpr_mm_settings
2. Trigger Check: Use the browser_navigate tool to go to wp-admin/nav-menus.php as an administrator and check for the alert or the presence of the <script> tag in the DOM.

9. Alternative Approaches

• Widget Injection: If the Mega Menu CPT wpr_mega_menu is directly editable by Contributors (as suggested by 'capability_type' => 'post'), the attacker can navigate to wp-admin/post.php?post=<MEGA_MENU_ID>&action=elementor and use an unescaped widget property (e.g., "Custom ID" field in a Royal Addons widget) to store the XSS.
• Search Query XSS: Check if the wpr_backend_widget_search_query_results AJAX action reflects the search term unsanitized, which would lead to Reflected XSS.