CVE-2026-5162

OVERVIEW: CVE-2026-5162 is a Stored Cross-Site Scripting (XSS) vulnerability affecting the Royal Addons for Elementor WordPress plugin in versions up to and including 1.7.1056. The flaw exists in the Instagram Feed widget's 'instagram_follow_text' setting, where insufficient input sanitization and output escaping allow attackers to inject arbitrary web scripts that persist in the application and execute when users access affected pages. SEVERITY: The vulnerability carries a CVSS 3.1 score of 6.4 (Medium), with a network-based attack vector requiring low complexity and low privilege requirements (Contributor-level access or above). The impact is limited to confidentiality and integrity breaches with no availability impact, though the vulnerability has a changed scope, meaning the attack can affect resources beyond the vulnerable component's scope. EXPLOITATION STATUS: There is no evidence of active exploitation in the wild. The vulnerability does not appear on the Known Exploited Vulnerabilities (KEV) catalog and is classified as inactive on threat intelligence hot lists. The EPSS score of 0.00036 indicates extremely low probability of exploitation in the wild, with limited community attention compared to other disclosed vulnerabilities. Organizations should prioritize patching based on their WordPress deployment criticality rather than imminent threat indicators.