CVE-2026-5428

The Royal Elementor Addons plugin for WordPress contains a vulnerability that allows attackers with Author-level access or higher to inject malicious code into image captions in the Image Grid/Slider/Carousel widget, which can then be executed when a user views the page containing the compromised image. This occurs because the plugin does not properly sanitize the image alt attribute, allowing attackers to inject arbitrary web scripts. As a result, authenticated attackers can inject malicious code that will execute whenever a user accesses a page displaying the malicious image.

Based on public CVE data (MITRE/NVD).