Is Royal Addons for Elementor safe to use?

Laskyr does not give safety verdicts. No known unpatched vulnerabilities in the latest version (1.7.1070). As of 2026-11-01. 89 issues are on record for older versions; version 1.7.1070 or newer fixes all of them that state a fix. Keep Royal Addons for Elementor on the latest version (1.7.1070) and remove it if you do not use it.

Which versions of Royal Addons for Elementor are vulnerable?

Known issues on record (newest first): Cross-site scripting (XSS) (1.7.1037 up to (not including) 1.7.1070, fixed in 1.7.1070); Information disclosure (1.3.81 up to (not including) 1.7.1070, fixed in 1.7.1070); Missing authorization check (1.3.68 up to (not including) 1.7.1070, fixed in 1.7.1070); Missing authorization check (1.3.71 up to (not including) 1.7.1070, fixed in 1.7.1070); Stored cross-site scripting (XSS) (1.7.1069 and older, fixed in 1.7.1070); Missing authorization check (1.7.1069 and older, fixed in 1.7.1070). The full list with sources is on this page.

What is the latest version of Royal Addons for Elementor?

1.7.1070, according to wordpress.org (last updated 2026-10-23). It has 600,000+ active installs.

What should I do if my Royal Addons for Elementor is out of date?

Take a backup, then update it from Dashboard > Updates (or run wp plugin update royal-elementor-addons). If you cannot update right away, deactivate it until you can. If you think the site was already attacked, run a free scan at https://laskyr.com/scan.

Plugins · royal-elementor-addons · data as of 2026-11-01

Is Royal Addons for Elementor safe? Known vulnerabilities and latest version

Latest version: 1.7.1070
Last updated: 2026-10-23
Active installs: 600,000+
Known issues on record: 89
Unpatched in latest: 0
Tested up to WP: 7.1.4 · PHP 5.6+

Elementor templates, Header footer builder, Elementor Post Grid, Woocommerce Grid builder, Slider, Forms, Gallery, Nav menu addons, Elementor widgets. — by WP Royal

What to do

Update to the latest version (1.7.1070). Anything older than 1.7.1070 has at least one known issue listed below. Dashboard → Updates, or Plugins → “update now”.
If you cannot update right away, deactivate it until you can.
Turn on auto-updates for it: Plugins → “Enable auto-updates” on its row.
If you ran a vulnerable version and something looks off (spam pages, strange admins, redirects), run the free scan.

With WP-CLI: wp plugin get royal-elementor-addons --field=version shows what you run; wp plugin update royal-elementor-addons updates it.

Check your version

Known vulnerabilities

89 on record, newest first. “Affected” is the version range the source gives; “fixed in” is the version the source names, or (marked *) the first wordpress.org release after the last affected version.

medium 6.8 CVE-2026-107098 · published 2026-10-28

Cross-site scripting (XSS) in Royal Addons for Elementor (1.7.1037 up to (not including) 1.7.1070)

Affected: 1.7.1037 up to (not including) 1.7.1070
Fixed in: 1.7.1070
Access needed (per CVSS): Needs an admin-level account; someone on the site has to click a link or open a page
Range from: CVE record (the advisory publisher) · score by CISA ADP

Details from the advisory

The Royal Addons for Elementor WordPress plugin before 1.7.1070 does not sanitise and escape one of its map widget's size settings before concatenating it into an HTML attribute, allowing users with the Contributor role or above to inject JavaScript that runs in the browser of any user who views the page, including an administrator reviewing a pending submission.

NVD CVE-2026-107098 WPScan advisory

medium 5.3 CVE-2026-107100 · published 2026-10-28

Information disclosure in Royal Addons for Elementor (1.3.81 up to (not including) 1.7.1070)

Affected: 1.3.81 up to (not including) 1.7.1070
Fixed in: 1.7.1070
Access needed (per CVSS): No login needed
Range from: CVE record (the advisory publisher) · score by CISA ADP

Details from the advisory

The Royal Addons for Elementor WordPress plugin before 1.7.1070 does not verify that a requested post is publicly viewable before returning its content via an unauthenticated AJAX action, relying only on the published status and not on the post type's visibility, allowing unauthenticated users to disclose the content of posts stored in non-public post types, for example captured contact-form submissions containing names, email addresses and messages.

NVD CVE-2026-107100 WPScan advisory

low 3.8 CVE-2026-106647 · published 2026-10-28

Missing authorization check in Royal Addons for Elementor (1.3.68 up to (not including) 1.7.1070)

Affected: 1.3.68 up to (not including) 1.7.1070
Fixed in: 1.7.1070
Access needed (per CVSS): Needs an admin-level account
Range from: CVE record (the advisory publisher) · score by CISA ADP

Details from the advisory

The Royal Addons for Elementor WordPress plugin before 1.7.1070 does not scope a contact form's email delivery configuration to the form's own document or owner, instead storing it in a site-global namespace keyed only on a non-secret, author-chosen identifier that is exposed in public page source, allowing users with the Author role or above to overwrite another user's form configuration and have that form's submissions delivered to an attacker-controlled address.

NVD CVE-2026-106647 WPScan advisory

medium 5.3 CVE-2026-107097 · published 2026-10-28

Missing authorization check in Royal Addons for Elementor (1.3.71 up to (not including) 1.7.1070)

Affected: 1.3.71 up to (not including) 1.7.1070
Fixed in: 1.7.1070
Access needed (per CVSS): No login needed
Range from: CVE record (the advisory publisher) · score by CISA ADP

Details from the advisory

The Royal Addons for Elementor WordPress plugin before 1.7.1070 does not perform any authorization check before using the site owner's stored Mailchimp credential to add subscriber records to an audience chosen by the request, allowing unauthenticated attackers to inject arbitrary email addresses and contact details into the site owner's Mailchimp account as confirmed subscribers.

NVD CVE-2026-107097 WPScan advisory

medium 6.5 CVE-2026-97254 · published 2026-10-26

Stored cross-site scripting (XSS) in Royal Addons for Elementor (1.7.1069 and older)

Affected: 1.7.1069 and older
Fixed in: 1.7.1070
Access needed (per CVSS): Needs a low-level account (e.g. subscriber); someone on the site has to click a link or open a page
Range from: CVE record (the advisory publisher) · score by Patchstack

Details from the advisory

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WProyal Royal Elementor Addons royal-elementor-addons allows Stored XSS.This issue affects Royal Elementor Addons: from n/a through 1.7.1069.

NVD CVE-2026-97254 Patchstack advisory

medium 5.3 CVE-2026-97255 · published 2026-10-26

Missing authorization check in Royal Addons for Elementor (1.7.1069 and older)

Affected: 1.7.1069 and older
Fixed in: 1.7.1070
Access needed (per CVSS): No login needed
Range from: CVE record (the advisory publisher) · score by Patchstack

Details from the advisory

Authorization Bypass Through User-Controlled Key vulnerability in WProyal Royal Elementor Addons royal-elementor-addons allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Royal Elementor Addons: from n/a through 1.7.1069.

NVD CVE-2026-97255 Patchstack advisory

medium 6.5 CVE-2026-112865 · published 2026-10-26

Cross-site scripting (XSS) in Royal Addons for Elementor (1.7.1069 and older)

Affected: 1.7.1069 and older
Fixed in: 1.7.1070
Access needed (per CVSS): Needs a low-level account (e.g. subscriber); someone on the site has to click a link or open a page
Range from: CVE record (the advisory publisher) · score by Patchstack

Details from the advisory

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WProyal Royal Elementor Addons royal-elementor-addons allows DOM-Based XSS.This issue affects Royal Elementor Addons: from n/a through 1.7.1069.

NVD CVE-2026-112865 Patchstack advisory

high 7.6 CVE-2026-111851 · published 2026-10-22

Remote code execution in Royal Addons for Elementor (1.7.1068 and older)

Affected: 1.7.1068 and older
Fixed in: 1.7.1069
Access needed (per CVSS): Needs a low-level account (e.g. subscriber)
Range from: CVE record (the advisory publisher) · score by Patchstack

Details from the advisory

Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection') vulnerability in WProyal Royal Elementor Addons royal-elementor-addons allows Code Injection.This issue affects Royal Elementor Addons: from n/a through 1.7.1068.

NVD CVE-2026-111851 Patchstack advisory

medium 5.4 CVE-2026-13407 · published 2026-09-16

Security issue in Royal Addons for Elementor (older than 1.7.1067)

Affected: older than 1.7.1067
Fixed in: 1.7.1067
Access needed (per CVSS): No login needed; someone on the site has to click a link or open a page
Range from: CVE record (the advisory publisher) · score by WPScan

Details from the advisory

The Royal Elementor Addons WordPress plugin before 1.7.1067 does not properly sanitize and escape values submitted through its form widget before including them in the body of administrator notification emails, allowing unauthenticated attackers to inject arbitrary HTML into emails sent to the site administrator on form submission.

NVD CVE-2026-13407 WPScan advisory

medium 5.3 CVE-2026-17585 · published 2026-09-12

Information disclosure in Royal Addons for Elementor (1.7.1066 and older)

Affected: 1.7.1066 and older
Fixed in: 1.7.1067 *
Access needed (per CVSS): No login needed
Range from: CVE record (the advisory publisher) · score by Wordfence

Details from the advisory

The Royal Addons for Elementor – Addons and Templates Kit for Elementor plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.7.1066 via the 'wpr_keyword' parameter. This makes it possible for unauthenticated attackers to extract arbitrary postmeta values from all published posts via character-by-character substring matching across the entire wp_postmeta table. The required nonce is emitted publicly via wp_localize_script on any frontend page that loads a Royal Elementor widget, meaning no authenticated session or prior action is needed to obtain it.

NVD CVE-2026-17585 Wordfence advisory Plugin source

medium 6.8 CVE-2026-19226 · published 2026-08-26

Stored cross-site scripting (XSS) in Royal Addons for Elementor (older than 1.7.1066)

Affected: older than 1.7.1066
Fixed in: 1.7.1066
Access needed (per CVSS): Needs an admin-level account; someone on the site has to click a link or open a page
Range from: CVE record (the advisory publisher) · score by CISA ADP

Details from the advisory

The Royal Addons for Elementor WordPress plugin before 1.7.1066 does not validate some widget settings before outputting them inside an HTML attribute, which could allow users with the Contributor role and above to perform Stored Cross-Site Scripting attacks.

NVD CVE-2026-19226 WPScan advisory

medium 5.3 CVE-2026-13404 · published 2026-08-26

Missing authorization check in Royal Addons for Elementor (older than 1.7.1066)

Affected: older than 1.7.1066
Fixed in: 1.7.1066
Access needed (per CVSS): No login needed
Range from: CVE record (the advisory publisher) · score by CISA ADP

Details from the advisory

The Royal Addons for Elementor WordPress plugin before 1.7.1066 does not perform any capability or ownership check (relying only on a publicly-scrapeable nonce) before writing like-count and visitor-tracking post meta keyed on an arbitrary post ID, allowing unauthenticated users to modify that metadata on any post, including private and draft posts.

NVD CVE-2026-13404 WPScan advisory

medium 5.3 CVE-2026-13406 · published 2026-08-26

Missing authorization check in Royal Addons for Elementor (older than 1.7.1066)

Affected: older than 1.7.1066
Fixed in: 1.7.1066
Access needed (per CVSS): No login needed
Range from: CVE record (the advisory publisher) · score by CISA ADP

Details from the advisory

The Royal Addons for Elementor WordPress plugin before 1.7.1066 does not perform any capability or nonce check before returning taxonomy term data for an arbitrary, caller-supplied taxonomy, allowing unauthenticated users to disclose the names and IDs of terms belonging to non-public taxonomies.

NVD CVE-2026-13406 WPScan advisory

medium 6.6 CVE-2026-13405 · published 2026-08-20

Remote code execution in Royal Addons for Elementor (older than 1.7.1066)

Affected: older than 1.7.1066
Fixed in: 1.7.1066
Access needed (per CVSS): Needs an admin-level account
Range from: CVE record (the advisory publisher) · score by CISA ADP

Details from the advisory

The Royal Addons for Elementor WordPress plugin before 1.7.1066 does not correctly sanitise custom widget markup before writing it to a file that is later executed, allowing users with the manage_options capability (and, on WordPress Multisite, non-super subsite administrators who do not otherwise hold code-execution capabilities) to execute arbitrary PHP code.

NVD CVE-2026-13405 WPScan advisory

high 8.8 CVE-2026-17123 · published 2026-08-16

Server-side request forgery (SSRF) in Royal Addons for Elementor (1.7.1064 and older)

Affected: 1.7.1064 and older
Fixed in: 1.7.1065 *
Access needed (per CVSS): Needs a low-level account (e.g. subscriber)
Range from: CVE record (the advisory publisher) · score by Wordfence

Details from the advisory

The Royal Elementor Addons plugin for WordPress is vulnerable to Server-Side Request Forgery in versions up to, and including, 1.7.1064 via the Form Builder widget's 'webhook_url' setting. The widget's render() method persists the attacker-controlled URL into the wpr_webhook_url_{widget_id} option on every render (including a Contributor previewing their own draft), and the wpr_form_builder_webhook AJAX handler — registered for both authenticated and unauthenticated callers — reads that option and dispatches the outbound request via the non-safe wp_remote_post(), with no host allowlist, no scheme restriction, and no private/loopback IP filter (the plugin's existing wpr_is_blocked_remote_host / wpr_is_private_or_local_ip helpers are not called on this path). This makes it possible for authenticated attackers, with Contributor-level access and above, to make web requests to arbitrary locations originating from the web application and can be used to query and modify information from internal services.

NVD CVE-2026-17123 Wordfence advisory Plugin source

medium 5.4 CVE-2026-19217 · published 2026-08-12

Stored cross-site scripting (XSS) in Royal Addons for Elementor (older than 1.7.1065)

Affected: older than 1.7.1065
Fixed in: 1.7.1065
Access needed (per CVSS): Needs a low-level account (e.g. subscriber); someone on the site has to click a link or open a page
Range from: CVE record (the advisory publisher) · score by CISA ADP

Details from the advisory

The Royal Addons for Elementor WordPress plugin before 1.7.1065 does not validate a widget setting used to build an HTML tag before outputting it, which could allow users with the Contributor role and above to perform Stored Cross-Site Scripting attacks.

NVD CVE-2026-19217 WPScan advisory

medium 5.3 CVE-2026-13402 · published 2026-07-17

Information disclosure in Royal Addons for Elementor (older than 1.7.1063)

Affected: older than 1.7.1063
Fixed in: 1.7.1063
Access needed (per CVSS): No login needed
Range from: CVE record (the advisory publisher) · score by CISA ADP

Details from the advisory

The Royal Addons for Elementor WordPress plugin before 1.7.1063 does not check the post status of menu items or the templates they reference in one of its REST endpoints, allowing unauthenticated users to retrieve the rendered HTML content of private or draft Elementor templates linked from non-public navigation menu items.

NVD CVE-2026-13402 WPScan advisory

medium 6.5 CVE-2026-8118 · published 2026-06-19

Path traversal / file read in Royal Addons for Elementor (1.7.1058 to 1.7.1059)

Affected: 1.7.1058 to 1.7.1059
Fixed in: 1.7.1060 *
Access needed (per CVSS): Needs a low-level account (e.g. subscriber)
Range from: CVE record (the advisory publisher) · score by Wordfence

Details from the advisory

The Royal Addons for Elementor – Addons and Templates Kit for Elementor plugin for WordPress is vulnerable to Arbitrary File Read in versions 1.7.1058 through 1.7.1059. This is due to the wpr_get_csv_handle() helper (introduced in version 1.7.1058 as part of the patch for CVE-2026-6229) falling back to is_readable() and fopen($source, 'r') on the attacker-controlled settings.table_upload_csv.url value when it does not parse as an HTTP URL, with no allow-list, traversal block, or extension check. This makes it possible for authenticated attackers, with Contributor-level access and above, to save a crafted wpr-data-table widget through Elementor's save_builder endpoint and have the rendered preview return the line-by-line contents of any file readable by the PHP process, including wp-config.php.

NVD CVE-2026-8118 Wordfence advisory Code change (fix)

medium 6.4 CVE-2026-6504 · published 2026-05-14

Stored cross-site scripting (XSS) in Royal Addons for Elementor (1.7.1058 and older)

Affected: 1.7.1058 and older
Fixed in: 1.7.1059 *
Access needed (per CVSS): Needs a low-level account (e.g. subscriber)
Range from: CVE record (the advisory publisher) · score by Wordfence

Details from the advisory

The Royal Elementor Addons and Templates plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'title_tag' parameter in all versions up to, and including, 1.7.1058 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

NVD CVE-2026-6504 Wordfence advisory Code change (fix)

medium 6.5 CVE-2026-27421 · published 2026-05-07

Stored cross-site scripting (XSS) in Royal Addons for Elementor (older than 1.7.1053)

Affected: older than 1.7.1053
Fixed in: 1.7.1053
Access needed (per CVSS): Needs a low-level account (e.g. subscriber); someone on the site has to click a link or open a page
Range from: CVE record (the advisory publisher) · score by Patchstack

Details from the advisory

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WProyal Royal Elementor Addons allows Stored XSS. This issue affects Royal Elementor Addons: from n/a before 1.7.1053.

NVD CVE-2026-27421 Patchstack advisory

medium 5.3 CVE-2026-25436 · published 2026-05-07

Missing authorization check in Royal Addons for Elementor (older than 1.7.1053)

Affected: older than 1.7.1053
Fixed in: 1.7.1053
Access needed (per CVSS): No login needed
Range from: CVE record (the advisory publisher) · score by Patchstack

Details from the advisory

Missing Authorization vulnerability in WProyal Royal Elementor Addons allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Royal Elementor Addons: from n/a before 1.7.1053.

NVD CVE-2026-25436 Patchstack advisory

high 7.2 CVE-2026-4803 · published 2026-05-05

Stored cross-site scripting (XSS) in Royal Addons for Elementor (1.7.1056 and older)

Affected: 1.7.1056 and older
Fixed in: 1.7.1057 *
Access needed (per CVSS): No login needed
Range from: CVE record (the advisory publisher) · score by Wordfence

Details from the advisory

The Royal Elementor Addons plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'status' parameter in the wpr_update_form_action_meta AJAX action in all versions up to, and including, 1.7.1056. This is due to insufficient input sanitization and output escaping, combined with a publicly leaked nonce that allows unauthenticated access to the AJAX handler. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

NVD CVE-2026-4803 Wordfence advisory Code change (fix)Plugin source

medium 6.4 CVE-2026-5159 · published 2026-05-05

Stored cross-site scripting (XSS) in Royal Addons for Elementor (1.7.1056 and older)

Affected: 1.7.1056 and older
Fixed in: 1.7.1057 *
Access needed (per CVSS): Needs a low-level account (e.g. subscriber)
Range from: CVE record (the advisory publisher) · score by Wordfence

Details from the advisory

The Royal Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Instagram Feed widget's 'instagram_follow_text' setting in all versions up to, and including, 1.7.1056 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Note that exploitation requires that an administrator has previously configured the Instagram Feed widget with a valid Instagram access token on the site.

NVD CVE-2026-5159 Wordfence advisory Code change (fix)Plugin source

medium 5.3 CVE-2026-4024 · published 2026-05-02

Missing authorization check in Royal Addons for Elementor (1.7.1056 and older)

Affected: 1.7.1056 and older
Fixed in: 1.7.1057 *
Access needed (per CVSS): No login needed
Range from: CVE record (the advisory publisher) · score by Wordfence

Details from the advisory

The Royal Addons for Elementor plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the `wpr_update_form_action_meta` AJAX action in all versions up to, and including, 1.7.1056. The handler is registered on both `wp_ajax` and `wp_ajax_nopriv` hooks, making it accessible to unauthenticated users. Although a nonce is verified, the nonce (`wpr-addons-js`) is publicly exposed in frontend JavaScript via `WprConfig.nonce` on any page that loads Royal Addons widgets, rendering the protection ineffective. The endpoint also lacks any capability or ownership checks and directly calls `update_post_meta()` with user-controlled input on a whitelisted set of form action meta keys. This makes it possible for unauthenticated attackers to modify form action configuration metadata (email, submissions, Mailchimp, and webhook settings) on any post, potentially leading to webhook/email action tampering and data exfiltration via modified webhook URLs.

NVD CVE-2026-4024 Wordfence advisory Plugin source

high 7.2 CVE-2026-6229 · published 2026-05-02

Server-side request forgery (SSRF) in Royal Addons for Elementor (1.7.1057 and older)

Affected: 1.7.1057 and older
Fixed in: 1.7.1058 *
Access needed (per CVSS): No login needed
Range from: CVE record (the advisory publisher) · score by Wordfence

Details from the advisory

The Royal Elementor Addons plugin for WordPress is vulnerable to Server-Side Request Forgery in versions up to, and including, 1.7.1057. This is due to insufficient validation of user-supplied URLs in the render_csv_data() function, which can be bypassed by including 'docs.google.com/spreadsheets' in a query parameter, and the subsequent use of these URLs in fopen() calls without blocking internal or private network addresses. This makes it possible for authenticated attackers, with Contributor-level access and above, to make requests to arbitrary URLs and retrieve sensitive information from internal services.

NVD CVE-2026-6229 Wordfence advisory Code change (fix)research.cleantalk.org Plugin source

medium 6.4 CVE-2026-5428 · published 2026-04-24

Stored cross-site scripting (XSS) in Royal Addons for Elementor (1.7.1056 and older)

Affected: 1.7.1056 and older
Fixed in: 1.7.1057 *
Access needed (per CVSS): Needs a low-level account (e.g. subscriber)
Range from: CVE record (the advisory publisher) · score by Wordfence

Details from the advisory

The Royal Elementor Addons plugin for WordPress is vulnerable to Stored Cross-Site Scripting via image captions in the Image Grid/Slider/Carousel widget in versions up to and including 1.7.1056. This is due to insufficient output escaping in the render_post_thumbnail() function, where wp_kses_post() is used instead of esc_attr() for the alt attribute context. This makes it possible for authenticated attackers, with Author-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses a page with the malicious image displayed in the media grid widget.

NVD CVE-2026-5428 Wordfence advisory Code change (fix)research.cleantalk.org Plugin source

medium 6.4 CVE-2026-5162 · published 2026-04-17

Stored cross-site scripting (XSS) in Royal Addons for Elementor (1.7.1056 and older)

Affected: 1.7.1056 and older
Fixed in: 1.7.1057 *
Access needed (per CVSS): Needs a low-level account (e.g. subscriber)
Range from: CVE record (the advisory publisher) · score by Wordfence

Details from the advisory

NVD CVE-2026-5162 Wordfence advisory Code change (fix)Plugin source

medium 5.3 CVE-2026-40763 · published 2026-04-15

Missing authorization check in Royal Addons for Elementor (1.7.1056 and older)

Affected: 1.7.1056 and older
Fixed in: 1.7.1057
Access needed (per CVSS): No login needed
Range from: CVE record (the advisory publisher) · score by Patchstack

Details from the advisory

Missing Authorization vulnerability in WP Royal Royal Elementor Addons royal-elementor-addons allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Royal Elementor Addons: from n/a through <= 1.7.1056.

NVD CVE-2026-40763 Patchstack advisory

medium 6.4 CVE-2026-0664 · published 2026-04-04

Stored cross-site scripting (XSS) in Royal Addons for Elementor (1.7.1049 and older)

Affected: 1.7.1049 and older
Fixed in: 1.7.1050 *
Access needed (per CVSS): Needs a low-level account (e.g. subscriber)
Range from: CVE record (the advisory publisher) · score by Wordfence

Details from the advisory

The Royal Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'button_text' parameter in all versions up to, and including, 1.7.1049 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

NVD CVE-2026-0664 Wordfence advisory Plugin source

medium 5.3 CVE-2026-2373 · published 2026-03-17

Information disclosure in Royal Addons for Elementor (1.7.1049 and older)

Affected: 1.7.1049 and older
Fixed in: 1.7.1050 *
Access needed (per CVSS): No login needed
Range from: CVE record (the advisory publisher) · score by Wordfence

Details from the advisory

The Royal Addons for Elementor – Addons and Templates Kit for Elementor plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 1.7.1049 via the get_main_query_args() function due to insufficient restrictions on which posts can be included. This makes it possible for unauthenticated attackers to extract contents of non-public custom post types, such as Contact Form 7 submissions or WooCommerce coupons.

NVD CVE-2026-2373 Wordfence advisory Code change (fix)

Show 59 older records

high 8.8 CVE-2025-13067 · published 2026-03-11

Arbitrary file upload in Royal Addons for Elementor (1.7.1049 and older)

Affected: 1.7.1049 and older
Fixed in: 1.7.1050 *
Access needed (per CVSS): Needs a low-level account (e.g. subscriber)
Range from: CVE record (the advisory publisher) · score by Wordfence

Details from the advisory

The Royal Addons for Elementor plugin for WordPress is vulnerable to arbitrary file upload in all versions up to, and including, 1.7.1049. This is due to insufficient file type validation detecting files named main.php, allowing a file with such a name to bypass sanitization. This makes it possible for authenticated attackers, with author-level access and above, to upload arbitrary files on the affected site's server which may make remote code execution possible.

NVD CVE-2025-13067 Wordfence advisory Code change (fix)

high 8.2 CVE-2026-28135 · published 2026-03-05

Security issue in Royal Addons for Elementor (1.7.1052 and older)

Affected: 1.7.1052 and older
Fixed in: 1.7.1053
Access needed (per CVSS): No login needed
Range from: CVE record (the advisory publisher) · score by Patchstack

Details from the advisory

Inclusion of Functionality from Untrusted Control Sphere vulnerability in WP Royal Royal Elementor Addons royal-elementor-addons allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Royal Elementor Addons: from n/a through <= 1.7.1052.

NVD CVE-2026-28135 Patchstack advisory

medium 6.4 CVE-2025-5092 · published 2025-11-20

Stored cross-site scripting (XSS) in Royal Addons for Elementor (1.7.1031 and older)

Affected: 1.7.1031 and older
Fixed in: 1.7.1032 *
Access needed (per CVSS): Needs a low-level account (e.g. subscriber)
Range from: CVE record (the advisory publisher) · score by Wordfence

Details from the advisory

Multiple plugins and/or themes for WordPress are vulnerable to Stored Cross-Site Scripting via the plugin's bundled lightGallery library (<= 2.8.3) in various versions due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

NVD CVE-2025-5092 Wordfence advisory Code change (fix)github.com

medium 6.4 CVE-2025-6251 · published 2025-11-19

Stored cross-site scripting (XSS) in Royal Addons for Elementor (1.7.1036 and older)

Affected: 1.7.1036 and older
Fixed in: 1.7.1037 *
Access needed (per CVSS): Needs a low-level account (e.g. subscriber)
Range from: CVE record (the advisory publisher) · score by Wordfence

Details from the advisory

The Royal Elementor Addons and Templates plugin for WordPress is vulnerable to Stored Cross-Site Scripting via $item['field_id'] in all versions up to, and including, 1.7.1036 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

NVD CVE-2025-6251 Wordfence advisory Plugin source

medium 5.4 CVE-2025-5338 · published 2025-06-26

Stored cross-site scripting (XSS) in Royal Addons for Elementor (1.7.1028 and older)

Affected: 1.7.1028 and older
Fixed in: 1.7.1029 *
Access needed (per CVSS): Needs a low-level account (e.g. subscriber); someone on the site has to click a link or open a page
Range from: CVE record (the advisory publisher) · score by NVD

Details from the advisory

The Royal Elementor Addons plugin for WordPress is vulnerable to Stored Cross-Site Scripting via multiple widgets in all versions up to, and including, 1.7.1028 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

NVD CVE-2025-5338 Wordfence advisory Code change (fix)wordpress.org Plugin source

medium 5.4 CVE-2025-3813 · published 2025-05-31

Stored cross-site scripting (XSS) in Royal Addons for Elementor (1.7.1020 and older)

Affected: 1.7.1020 and older
Fixed in: 1.7.1021 *
Access needed (per CVSS): Needs a low-level account (e.g. subscriber); someone on the site has to click a link or open a page
Range from: CVE record (the advisory publisher) · score by NVD

Details from the advisory

The Royal Elementor Addons and Templates plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘_elementor_data’ parameter in all versions up to, and including, 1.7.1020 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

NVD CVE-2025-3813 Wordfence advisory Plugin source

medium 5.4 CVE-2025-39361 · published 2025-05-07

Stored cross-site scripting (XSS) in Royal Addons for Elementor (1.7.1017 and older)

Affected: 1.7.1017 and older
Fixed in: 1.7.1018
Access needed (per CVSS): Needs a low-level account (e.g. subscriber); someone on the site has to click a link or open a page
Range from: CVE record (the advisory publisher) · score by NVD

Details from the advisory

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WP Royal Royal Elementor Addons royal-elementor-addons allows Stored XSS.This issue affects Royal Elementor Addons: from n/a through <= 1.7.1017.

NVD CVE-2025-39361 Patchstack advisory

medium 5.4 CVE-2024-12120 · published 2025-05-07

Stored cross-site scripting (XSS) in Royal Addons for Elementor (1.7.1017 and older)

Affected: 1.7.1017 and older
Fixed in: 1.7.1018 *
Access needed (per CVSS): Needs a low-level account (e.g. subscriber); someone on the site has to click a link or open a page
Range from: CVE record (the advisory publisher) · score by NVD

Details from the advisory

The Royal Elementor Addons and Templates plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Countdown widget display_message_text parameter in all versions up to, and including, 1.7.1017 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

NVD CVE-2024-12120 Wordfence advisory Code change (fix)

medium 6.5 CVE-2025-39543 · published 2025-04-16

Stored cross-site scripting (XSS) in Royal Addons for Elementor (1.3.977 and older)

Affected: 1.3.977 and older
Fixed in: 1.3.979
Access needed (per CVSS): Needs a low-level account (e.g. subscriber); someone on the site has to click a link or open a page
Range from: CVE record (the advisory publisher) · score by Patchstack

Details from the advisory

NVD CVE-2025-39543 Patchstack advisory

medium 4.9 CVE-2025-26990 · published 2025-04-15

Server-side request forgery (SSRF) in Royal Addons for Elementor (1.7.1006 and older)

Affected: 1.7.1006 and older
Fixed in: 1.7.1007
Access needed (per CVSS): Needs an admin-level account
Range from: CVE record (the advisory publisher) · score by NVD

Details from the advisory

Server-Side Request Forgery (SSRF) vulnerability in WP Royal Royal Elementor Addons royal-elementor-addons allows Server Side Request Forgery.This issue affects Royal Elementor Addons: from n/a through <= 1.7.1006.

NVD CVE-2025-26990 Patchstack advisory

medium 5.4 CVE-2025-1456 · published 2025-04-12

Stored cross-site scripting (XSS) in Royal Addons for Elementor (1.7.1012 and older)

Affected: 1.7.1012 and older
Fixed in: 1.7.1013 *
Access needed (per CVSS): Needs a low-level account (e.g. subscriber); someone on the site has to click a link or open a page
Range from: CVE record (the advisory publisher) · score by NVD

Details from the advisory

The Royal Elementor Addons and Templates plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the `widgetGrid`, `widgetCountDown`, and `widgetInstagramFeed` methods in all versions up to, and including, 1.7.1012 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

NVD CVE-2025-1456 Wordfence advisory Code change (fix)Plugin source

medium 5.4 CVE-2025-1455 · published 2025-04-12

Stored cross-site scripting (XSS) in Royal Addons for Elementor (1.7.1012 and older)

Affected: 1.7.1012 and older
Fixed in: 1.7.1013 *
Access needed (per CVSS): Needs a low-level account (e.g. subscriber); someone on the site has to click a link or open a page
Range from: CVE record (the advisory publisher) · score by NVD

Details from the advisory

The Royal Elementor Addons and Templates plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Woo Grid widget in all versions up to, and including, 1.7.1012 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

NVD CVE-2025-1455 Wordfence advisory Code change (fix)Plugin source

high 8.8 CVE-2025-1441 · published 2025-02-19

Cross-site request forgery (CSRF) in Royal Addons for Elementor (1.7.1007 and older)

Affected: 1.7.1007 and older
Fixed in: 1.7.1008 *
Access needed (per CVSS): No login needed; someone on the site has to click a link or open a page
Range from: CVE record (the advisory publisher) · score by NVD

Details from the advisory

The Royal Elementor Addons and Templates plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.7.1007. This is due to missing or incorrect nonce validation on the 'wpr_filter_woo_products' function. This makes it possible for unauthenticated attackers to inject malicious web scripts via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.

NVD CVE-2025-1441 Wordfence advisory Plugin source

medium 6.1 CVE-2025-0393 · published 2025-01-14

Cross-site request forgery (CSRF) in Royal Addons for Elementor (1.7.1006 and older)

Affected: 1.7.1006 and older
Fixed in: 1.7.1007 *
Access needed (per CVSS): No login needed; someone on the site has to click a link or open a page
Range from: CVE record (the advisory publisher) · score by NVD

Details from the advisory

The Royal Elementor Addons and Templates plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.7.1006. This is due to missing or incorrect nonce validation on the wpr_filter_grid_posts() function. This makes it possible for unauthenticated attackers to inject malicious web scripts via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.

NVD CVE-2025-0393 Wordfence advisory Code change (fix)wordpress.org Plugin source

medium 5.4 CVE-2024-56062 · published 2024-12-31

Stored cross-site scripting (XSS) in Royal Addons for Elementor (1.3.987 and older)

Affected: 1.3.987 and older
Fixed in: 1.7.1
Access needed (per CVSS): Needs a low-level account (e.g. subscriber); someone on the site has to click a link or open a page
Range from: CVE record (the advisory publisher) · score by NVD

Details from the advisory

NVD CVE-2024-56062 Patchstack advisory

medium 6.1 CVE-2024-56226 · published 2024-12-31

Reflected cross-site scripting (XSS) in Royal Addons for Elementor (1.7.1001 and older)

Affected: 1.7.1001 and older
Fixed in: 1.7.1002
Access needed (per CVSS): No login needed; someone on the site has to click a link or open a page
Range from: CVE record (the advisory publisher) · score by NVD

Details from the advisory

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WP Royal Royal Elementor Addons royal-elementor-addons allows Reflected XSS.This issue affects Royal Elementor Addons: from n/a through <= 1.7.1001.

NVD CVE-2024-56226 Patchstack advisory

medium 4.3 CVE-2024-56227 · published 2024-12-31

Missing authorization check in Royal Addons for Elementor (1.7.1001 and older)

Affected: 1.7.1001 and older
Fixed in: 1.7.1002
Access needed (per CVSS): Needs a low-level account (e.g. subscriber)
Range from: CVE record (the advisory publisher) · score by NVD

Details from the advisory

NVD CVE-2024-56227 Patchstack advisory

medium 4.3 CVE-2024-10798 · published 2024-11-28

Information disclosure in Royal Addons for Elementor (1.7.1003 and older)

Affected: 1.7.1003 and older
Fixed in: 1.7.1004 *
Access needed (per CVSS): Needs a low-level account (e.g. subscriber)
Range from: CVE record (the advisory publisher) · score by Wordfence

Details from the advisory

The Royal Elementor Addons and Templates plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 1.7.1003 via the 'wpr-template' shortcode due to insufficient restrictions on which posts can be included. This makes it possible for authenticated attackers, with Contributor-level access and above, to extract data from private or draft posts created via Elementor that they should not have access to.

NVD CVE-2024-10798 Wordfence advisory Code change (fix)

medium 5.4 CVE-2024-9668 · published 2024-11-13

Stored cross-site scripting (XSS) in Royal Addons for Elementor (1.7.1001 and older)

Affected: 1.7.1001 and older
Fixed in: 1.7.1002 *
Access needed (per CVSS): Needs a low-level account (e.g. subscriber); someone on the site has to click a link or open a page
Range from: CVE record (the advisory publisher) · score by NVD

Details from the advisory

The Royal Elementor Addons and Templates plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Countdown widget in all versions up to, and including, 1.7.1001 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

NVD CVE-2024-9668 Wordfence advisory Plugin source

medium 5.4 CVE-2024-9682 · published 2024-11-13

Stored cross-site scripting (XSS) in Royal Addons for Elementor (1.7.1001 and older)

Affected: 1.7.1001 and older
Fixed in: 1.7.1002 *
Access needed (per CVSS): Needs a low-level account (e.g. subscriber); someone on the site has to click a link or open a page
Range from: CVE record (the advisory publisher) · score by NVD

Details from the advisory

The Royal Elementor Addons and Templates plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Form Builder widget in all versions up to, and including, 1.7.1001 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

NVD CVE-2024-9682 Wordfence advisory Plugin source

medium 5.4 CVE-2024-9059 · published 2024-11-13

Stored cross-site scripting (XSS) in Royal Addons for Elementor (1.7.1001 and older)

Affected: 1.7.1001 and older
Fixed in: 1.7.1002 *
Access needed (per CVSS): Needs a low-level account (e.g. subscriber); someone on the site has to click a link or open a page
Range from: CVE record (the advisory publisher) · score by NVD

Details from the advisory

The Royal Elementor Addons and Templates plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Google Maps widget in all versions up to, and including, 1.7.1001 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

NVD CVE-2024-9059 Wordfence advisory Plugin source

high 7.2 CVE-2024-50442 · published 2024-10-28

Security issue in Royal Addons for Elementor (1.3.980 and older)

Affected: 1.3.980 and older
Fixed in: 1.3.981
Access needed (per CVSS): Needs an admin-level account
Range from: CVE record (the advisory publisher) · score by NVD

Details from the advisory

Improper Restriction of XML External Entity Reference vulnerability in WP Royal Royal Elementor Addons royal-elementor-addons allows XML Injection.This issue affects Royal Elementor Addons: from n/a through <= 1.3.980.

NVD CVE-2024-50442 Patchstack advisory

medium 4.3 CVE-2024-7417 · published 2024-10-17

Information disclosure in Royal Addons for Elementor (1.3.986 and older)

Affected: 1.3.986 and older
Fixed in: 1.3.987 *
Access needed (per CVSS): Needs a low-level account (e.g. subscriber)
Range from: CVE record (the advisory publisher) · score by Wordfence

Details from the advisory

The Royal Elementor Addons and Templates plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 1.3.986 via the data_fetch. This makes it possible for authenticated attackers, with subscriber-level access and above, to extract data from password protected posts.

NVD CVE-2024-7417 Wordfence advisory Code change (fix)Plugin source

medium 6.4 CVE-2024-8482 · published 2024-10-08

Stored cross-site scripting (XSS) in Royal Addons for Elementor (1.3.986 and older)

Affected: 1.3.986 and older
Fixed in: 1.3.987 *
Access needed (per CVSS): Needs a low-level account (e.g. subscriber)
Range from: CVE record (the advisory publisher) · score by Wordfence

Details from the advisory

The Royal Elementor Addons and Templates plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘url’ parameter in all versions up to, and including, 1.3.982 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

NVD CVE-2024-8482 Wordfence advisory Plugin source

medium 5.4 CVE-2024-44001 · published 2024-09-18

Cross-site scripting (XSS) in Royal Addons for Elementor (1.3.982 and older)

Affected: 1.3.982 and older
Fixed in: 1.3.985
Access needed (per CVSS): Needs a low-level account (e.g. subscriber); someone on the site has to click a link or open a page
Range from: CVE record (the advisory publisher) · score by NVD

Details from the advisory

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WP Royal Royal Elementor Addons royal-elementor-addons.This issue affects Royal Elementor Addons: from n/a through <= 1.3.982.

NVD CVE-2024-44001 Patchstack advisory

medium 5.4 CVE-2024-5818 · published 2024-07-24

DOM-based cross-site scripting (XSS) in Royal Addons for Elementor (1.3.980 and older)

Affected: 1.3.980 and older
Fixed in: 1.3.981 *
Access needed (per CVSS): Needs a low-level account (e.g. subscriber); someone on the site has to click a link or open a page
Range from: CVE record (the advisory publisher) · score by NVD

Details from the advisory

The Royal Elementor Addons and Templates plugin for WordPress is vulnerable to Stored DOM-based Cross-Site Scripting via the plugin's Magazine Grid/Slider widget in all versions up to, and including, 1.3.980 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

NVD CVE-2024-5818 Wordfence advisory Code change (fix)

medium 5.4 CVE-2024-4488 · published 2024-06-07

Stored cross-site scripting (XSS) in Royal Addons for Elementor (1.3.976 and older)

Affected: 1.3.976 and older
Fixed in: 1.3.977 *
Access needed (per CVSS): Needs a low-level account (e.g. subscriber); someone on the site has to click a link or open a page
Range from: CVE record (the advisory publisher) · score by NVD

Details from the advisory

The Royal Elementor Addons and Templates for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘inline_list’ parameter in versions up to, and including, 1.3.976 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

NVD CVE-2024-4488 Wordfence advisory Code change (fix)Plugin source

medium 5.4 CVE-2024-4489 · published 2024-06-07

Stored cross-site scripting (XSS) in Royal Addons for Elementor (1.3.976 and older)

Affected: 1.3.976 and older
Fixed in: 1.3.977 *
Access needed (per CVSS): Needs a low-level account (e.g. subscriber); someone on the site has to click a link or open a page
Range from: CVE record (the advisory publisher) · score by NVD

Details from the advisory

The Royal Elementor Addons and Templates plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘custom_upload_mimes’ function in versions up to, and including, 1.3.976 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

NVD CVE-2024-4489 Wordfence advisory Code change (fix)Plugin source

medium 5.4 CVE-2024-4342 · published 2024-06-01

Stored cross-site scripting (XSS) in Royal Addons for Elementor (1.3.975 and older)

Affected: 1.3.975 and older
Fixed in: 1.3.976 *
Access needed (per CVSS): Needs a low-level account (e.g. subscriber); someone on the site has to click a link or open a page
Range from: CVE record (the advisory publisher) · score by NVD

Details from the advisory

The Royal Elementor Addons and Templates plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's image hotspot, image accordion, off canvas, woogrid, and product mini cart widgets in all versions up to, and including, 1.3.975 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

NVD CVE-2024-4342 Wordfence advisory Code change (fix)

medium 5.4 CVE-2024-4087 · published 2024-06-01

Stored cross-site scripting (XSS) in Royal Addons for Elementor (1.3.975 and older)

Affected: 1.3.975 and older
Fixed in: 1.3.976 *
Access needed (per CVSS): Needs a low-level account (e.g. subscriber); someone on the site has to click a link or open a page
Range from: CVE record (the advisory publisher) · score by NVD

Details from the advisory

The Royal Elementor Addons and Templates plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Back to Top widget in all versions up to, and including, 1.3.975 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

NVD CVE-2024-4087 Wordfence advisory Code change (fix)Plugin source

critical 9.8 CVE-2024-32786 · published 2024-05-17

Authentication bypass in Royal Addons for Elementor (1.3.93 and older)

Affected: 1.3.93 and older
Fixed in: 1.3.95
Access needed (per CVSS): No login needed
Range from: CVE record (the advisory publisher) · score by NVD

Details from the advisory

Authentication Bypass by Spoofing vulnerability in WP Royal Royal Elementor Addons allows Functionality Bypass.This issue affects Royal Elementor Addons: from n/a through 1.3.93.

NVD CVE-2024-32786 Patchstack advisory

medium 5.4 CVE-2024-3887 · published 2024-05-16

Stored cross-site scripting (XSS) in Royal Addons for Elementor (1.3.974 and older)

Affected: 1.3.974 and older
Fixed in: 1.3.975 *
Access needed (per CVSS): Needs a low-level account (e.g. subscriber); someone on the site has to click a link or open a page
Range from: CVE record (the advisory publisher) · score by NVD

Details from the advisory

The Royal Elementor Addons and Templates plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Form Builder widget in all versions up to, and including, 1.3.974 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

NVD CVE-2024-3887 Wordfence advisory Code change (fix)

medium 6.4 CVE-2024-3675 · published 2024-05-02

Stored cross-site scripting (XSS) in Royal Addons for Elementor (1.3.971 and older)

Affected: 1.3.971 and older
Fixed in: 1.3.972 *
Access needed (per CVSS): Needs a low-level account (e.g. subscriber)
Range from: CVE record (the advisory publisher) · score by Wordfence

Details from the advisory

The Royal Elementor Addons and Templates plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Flip Carousel, Flip Box, Post Grid, and Taxonomy List widgets in all versions up to, and including, 1.3.971 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

NVD CVE-2024-3675 Wordfence advisory Code change (fix)Plugin source

critical 9.8 CVE-2024-1567 · published 2024-05-02

Cross-site scripting (XSS) in Royal Addons for Elementor (1.3.94 and older)

Affected: 1.3.94 and older
Fixed in: 1.3.95 *
Access needed (per CVSS): No login needed
Range from: CVE record (the advisory publisher) · score by NVD

Details from the advisory

The Royal Elementor Addons and Templates plugin for WordPress is vulnerable to limited file uploads due to missing file type validation in the 'file_validity' function in all versions up to, and including, 1.3.94. This makes it possible for unauthenticated attackers to upload dangerous file types such as .svgz on the affected site's server which may make cross-site scripting or remote code execution possible.

NVD CVE-2024-1567 Wordfence advisory Code change (fix)Plugin source

medium 6.4 CVE-2024-2798 · published 2024-04-23

Stored cross-site scripting (XSS) in Royal Addons for Elementor (1.3.971 and older)

Affected: 1.3.971 and older
Fixed in: 1.3.972 *
Access needed (per CVSS): Needs a low-level account (e.g. subscriber)
Range from: CVE record (the advisory publisher) · score by Wordfence

Details from the advisory

The Royal Elementor Addons and Templates plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's widget containers in all versions up to, and including, 1.3.971 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

NVD CVE-2024-2798 Wordfence advisory Code change (fix)

medium 6.4 CVE-2024-2799 · published 2024-04-23

Stored cross-site scripting (XSS) in Royal Addons for Elementor (1.3.971 and older)

Affected: 1.3.971 and older
Fixed in: 1.3.972 *
Access needed (per CVSS): Needs a low-level account (e.g. subscriber)
Range from: CVE record (the advisory publisher) · score by Wordfence

Details from the advisory

The Royal Elementor Addons and Templates plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Image Grid & Advanced Text widget HTML tags in all versions up to, and including, 1.3.96 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

NVD CVE-2024-2799 Wordfence advisory Code change (fix)

medium 6.4 CVE-2024-3889 · published 2024-04-23

Stored cross-site scripting (XSS) in Royal Addons for Elementor (1.3.971 and older)

Affected: 1.3.971 and older
Fixed in: 1.3.972 *
Access needed (per CVSS): Needs a low-level account (e.g. subscriber)
Range from: CVE record (the advisory publisher) · score by Wordfence

Details from the advisory

The Royal Elementor Addons and Templates plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Advanced Accordion widget in all versions up to, and including, 1.3.971 due to insufficient input sanitization and output escaping on user supplied attributes like 'accordion_title_tag'. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

NVD CVE-2024-3889 Wordfence advisory Code change (fix)

medium 5.4 CVE-2024-31236 · published 2024-04-07

Stored cross-site scripting (XSS) in Royal Addons for Elementor (1.3.93 and older)

Affected: 1.3.93 and older
Fixed in: 1.3.95
Access needed (per CVSS): Needs a low-level account (e.g. subscriber); someone on the site has to click a link or open a page
Range from: CVE record (the advisory publisher) · score by NVD

Details from the advisory

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WP Royal Royal Elementor Addons allows Stored XSS.This issue affects Royal Elementor Addons: from n/a through 1.3.93.

NVD CVE-2024-31236 Patchstack advisory

medium 5.4 CVE-2024-1500 · published 2024-03-07

Stored cross-site scripting (XSS) in Royal Addons for Elementor (1.3.91 and older)

Affected: 1.3.91 and older
Fixed in: 1.3.92 *
Access needed (per CVSS): Needs a low-level account (e.g. subscriber); someone on the site has to click a link or open a page
Range from: CVE record (the advisory publisher) · score by Wordfence

Details from the advisory

The Royal Elementor Addons and Templates plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Logo Widget in all versions up to, and including, 1.3.91 due to insufficient input sanitization and output escaping on user supplied URLs. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

NVD CVE-2024-1500 Wordfence advisory Code change (fix)Plugin source

medium 4.3 CVE-2024-0514 · published 2024-02-29

Cross-site request forgery (CSRF) in Royal Addons for Elementor (1.3.87 and older)

Affected: 1.3.87 and older
Fixed in: 1.3.88 *
Access needed (per CVSS): No login needed; someone on the site has to click a link or open a page
Range from: CVE record (the advisory publisher) · score by Wordfence

Details from the advisory

The Royal Elementor Addons and Templates plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.3.87. This is due to missing or incorrect nonce validation on the add_to_compare function. This makes it possible for unauthenticated attackers to add items to user compare lists via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.

NVD CVE-2024-0514 Wordfence advisory Code change (fix)

medium 4.3 CVE-2024-0515 · published 2024-02-29

Cross-site request forgery (CSRF) in Royal Addons for Elementor (1.3.87 and older)

Affected: 1.3.87 and older
Fixed in: 1.3.88 *
Access needed (per CVSS): No login needed; someone on the site has to click a link or open a page
Range from: CVE record (the advisory publisher) · score by Wordfence

Details from the advisory

The Royal Elementor Addons and Templates plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.3.87. This is due to missing or incorrect nonce validation on the remove_from_compare function. This makes it possible for unauthenticated attackers to remove items from user compare lists via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.

NVD CVE-2024-0515 Wordfence advisory Code change (fix)

medium 5.3 CVE-2024-0516 · published 2024-02-29

Missing authorization check in Royal Addons for Elementor (1.3.87 and older)

Affected: 1.3.87 and older
Fixed in: 1.3.88 *
Access needed (per CVSS): No login needed
Range from: CVE record (the advisory publisher) · score by Wordfence

Details from the advisory

The Royal Elementor Addons and Templates plugin for WordPress is vulnerable to unauthorized post metadata update due to a missing capability check on the wpr_update_form_action_meta function in all versions up to, and including, 1.3.87. This makes it possible for unauthenticated attackers to update certain metadata.

NVD CVE-2024-0516 Wordfence advisory Code change (fix)

medium 4.3 CVE-2024-0512 · published 2024-02-29

Cross-site request forgery (CSRF) in Royal Addons for Elementor (1.3.87 and older)

Affected: 1.3.87 and older
Fixed in: 1.3.88 *
Access needed (per CVSS): No login needed; someone on the site has to click a link or open a page
Range from: CVE record (the advisory publisher) · score by Wordfence

Details from the advisory

The Royal Elementor Addons and Templates plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.3.87. This is due to missing or incorrect nonce validation on the add_to_wishlist function. This makes it possible for unauthenticated attackers to add items to user wishlists via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.

NVD CVE-2024-0512 Wordfence advisory Code change (fix)

medium 4.3 CVE-2024-0513 · published 2024-02-29

Cross-site request forgery (CSRF) in Royal Addons for Elementor (1.3.87 and older)

Affected: 1.3.87 and older
Fixed in: 1.3.88 *
Access needed (per CVSS): No login needed; someone on the site has to click a link or open a page
Range from: CVE record (the advisory publisher) · score by Wordfence

Details from the advisory

The Royal Elementor Addons and Templates plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.3.87. This is due to missing or incorrect nonce validation on the remove_from_wishlist function. This makes it possible for unauthenticated attackers to remove items from user wishlists via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.

NVD CVE-2024-0513 Wordfence advisory Code change (fix)

medium 6.4 CVE-2024-0442 · published 2024-02-29

Stored cross-site scripting (XSS) in Royal Addons for Elementor (1.3.87 and older)

Affected: 1.3.87 and older
Fixed in: 1.3.88 *
Access needed (per CVSS): Needs a low-level account (e.g. subscriber)
Range from: CVE record (the advisory publisher) · score by Wordfence

Details from the advisory

The Royal Elementor Addons and Templates plugin for WordPress is vulnerable to Stored Cross-Site Scripting via element URL parameters in all versions up to, and including, 1.3.87 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers with contributor access or higher to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

NVD CVE-2024-0442 Wordfence advisory Code change (fix)

medium 4.3 CVE-2024-0511 · published 2024-02-08

Cross-site request forgery (CSRF) in Royal Addons for Elementor (1.3.87 and older)

Affected: 1.3.87 and older
Fixed in: 1.3.88 *
Access needed (per CVSS): No login needed; someone on the site has to click a link or open a page
Range from: CVE record (the advisory publisher) · score by NVD

Details from the advisory

The Royal Elementor Addons and Templates plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.3.87. This is due to missing or incorrect nonce validation on the wpr_update_form_action_meta function. This makes it possible for unauthenticated attackers to post metadata via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.

NVD CVE-2024-0511 Wordfence advisory Code change (fix)

high 8.8 CVE-2022-47175 · published 2023-10-06

Cross-site request forgery (CSRF) in Royal Addons for Elementor (1.3.75 and older)

Affected: 1.3.75 and older
Fixed in: 1.3.76
Access needed (per CVSS): No login needed; someone on the site has to click a link or open a page
Range from: CVE record (the advisory publisher) · score by NVD

Details from the advisory

Cross-Site Request Forgery (CSRF) vulnerability in P Royal Royal Elementor Addons and Templates plugin <= 1.3.75 versions.

NVD CVE-2022-47175 Patchstack advisory

medium 5.3 CVE-2023-3709 · published 2023-07-18

Information disclosure in Royal Addons for Elementor (1.3.70 and older)

Affected: 1.3.70 and older
Fixed in: 1.3.71 *
Access needed (per CVSS): No login needed
Range from: CVE record (the advisory publisher) · score by Wordfence

Details from the advisory

The Royal Elementor Addons plugin for WordPress is vulnerable to unauthenticated API key disclosure in versions up to, and including, 1.3.70 due to the plugin adding the API key to the source code of any page running the MailChimp block. This makes it possible for unauthenticated attackers to obtain a site's MailChimp API key. We recommend resetting any MailChimp API keys if running a vulnerable version of this plugin with the MailChimp block enabled as the API key may have been compromised.

NVD CVE-2023-3709 Wordfence advisory Code change (fix)

high 8.8 CVE-2022-4700 · published 2023-01-10

Missing authorization check in Royal Addons for Elementor (1.3.59 and older)

Affected: 1.3.59 and older
Fixed in: 1.3.60 *
Access needed (per CVSS): Needs a low-level account (e.g. subscriber)
Range from: CVE record (the advisory publisher) · score by NVD

Details from the advisory

The Royal Elementor Addons plugin for WordPress is vulnerable to insufficient access control in the 'wpr_activate_required_theme' AJAX action in versions up to, and including, 1.3.59. This allows any authenticated user, including those with subscriber-level permissions, to activate the 'royal-elementor-kit' theme. If no such theme is installed doing so can also impact site availability as the site attempts to load a nonexistent theme.

NVD CVE-2022-4700 Wordfence advisory Wordfence advisory Plugin source

high 8.8 CVE-2022-4701 · published 2023-01-10

Missing authorization check in Royal Addons for Elementor (1.3.59 and older)

Affected: 1.3.59 and older
Fixed in: 1.3.60 *
Access needed (per CVSS): Needs a low-level account (e.g. subscriber)
Range from: CVE record (the advisory publisher) · score by NVD

Details from the advisory

The Royal Elementor Addons plugin for WordPress is vulnerable to insufficient access control in the 'wpr_activate_required_plugins' AJAX action in versions up to, and including, 1.3.59. This allows any authenticated user, including those with subscriber-level permissions, to activate the 'contact-form-7', 'media-library-assistant', or 'woocommerce' plugins if they are installed on the site.

NVD CVE-2022-4701 Wordfence advisory Wordfence advisory Plugin source

medium 6.5 CVE-2022-4702 · published 2023-01-10

Missing authorization check in Royal Addons for Elementor (1.3.59 and older)

Affected: 1.3.59 and older
Fixed in: 1.3.60 *
Access needed (per CVSS): Needs a low-level account (e.g. subscriber)
Range from: CVE record (the advisory publisher) · score by NVD

Details from the advisory

The Royal Elementor Addons plugin for WordPress is vulnerable to insufficient access control in the 'wpr_fix_royal_compatibility' AJAX action in versions up to, and including, 1.3.59. This allows any authenticated user, including those with subscriber-level permissions, to deactivate every plugin on the site unless it is part of an extremely limited hardcoded selection. This also switches the site to the 'royal-elementor-kit' theme, potentially resulting in availability issues.

NVD CVE-2022-4702 Wordfence advisory Wordfence advisory Plugin source

high 8.1 CVE-2022-4703 · published 2023-01-10

Missing authorization check in Royal Addons for Elementor (1.3.59 and older)

Affected: 1.3.59 and older
Fixed in: 1.3.60 *
Access needed (per CVSS): Needs a low-level account (e.g. subscriber)
Range from: CVE record (the advisory publisher) · score by NVD

Details from the advisory

The Royal Elementor Addons plugin for WordPress is vulnerable to insufficient access control in the 'wpr_reset_previous_import' AJAX action in versions up to, and including, 1.3.59. This allows any authenticated user, including those with subscriber-level permissions, to reset previously imported data.

NVD CVE-2022-4703 Wordfence advisory Wordfence advisory Plugin source

high 8.1 CVE-2022-4704 · published 2023-01-10

Missing authorization check in Royal Addons for Elementor (1.3.59 and older)

Affected: 1.3.59 and older
Fixed in: 1.3.60 *
Access needed (per CVSS): Needs a low-level account (e.g. subscriber)
Range from: CVE record (the advisory publisher) · score by NVD

Details from the advisory

The Royal Elementor Addons plugin for WordPress is vulnerable to insufficient access control in the 'wpr_import_templates_kit' AJAX action in versions up to, and including, 1.3.59. This allows any authenticated user, including those with subscriber-level permissions, to import preset site configuration templates including images and settings.

NVD CVE-2022-4704 Wordfence advisory Wordfence advisory Plugin source

medium 4.3 CVE-2022-4705 · published 2023-01-10

Missing authorization check in Royal Addons for Elementor (1.3.59 and older)

Affected: 1.3.59 and older
Fixed in: 1.3.60 *
Access needed (per CVSS): Needs a low-level account (e.g. subscriber)
Range from: CVE record (the advisory publisher) · score by NVD

Details from the advisory

The Royal Elementor Addons plugin for WordPress is vulnerable to insufficient access control in the 'wpr_final_settings_setup' AJAX action in versions up to, and including, 1.3.59. This allows any authenticated user, including those with subscriber-level permissions, to finalize activation of preset site configuration templates, which can be chosen and imported via a separate action documented in CVE-2022-4704.

NVD CVE-2022-4705 Wordfence advisory Wordfence advisory Plugin source

medium 6.5 CVE-2022-4707 · published 2023-01-10

Cross-site request forgery (CSRF) in Royal Addons for Elementor (1.3.59 and older)

Affected: 1.3.59 and older
Fixed in: 1.3.60 *
Access needed (per CVSS): No login needed; someone on the site has to click a link or open a page
Range from: CVE record (the advisory publisher) · score by NVD

Details from the advisory

The Royal Elementor Addons plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.3.59. This is due to missing nonce validation in the 'wpr_create_mega_menu_template' AJAX function. This allows unauthenticated attackers to create Mega Menu templates, granted they can trick an administrator into performing an action, such as clicking a link.

NVD CVE-2022-4707 Wordfence advisory Wordfence advisory Plugin source

medium 6.5 CVE-2022-4708 · published 2023-01-10

Missing authorization check in Royal Addons for Elementor (1.3.59 and older)

Affected: 1.3.59 and older
Fixed in: 1.3.60 *
Access needed (per CVSS): Needs a low-level account (e.g. subscriber)
Range from: CVE record (the advisory publisher) · score by NVD

Details from the advisory

The Royal Elementor Addons plugin for WordPress is vulnerable to insufficient access control in the 'wpr_save_template_conditions' AJAX action in versions up to, and including, 1.3.59. This allows any authenticated user, including those with subscriber-level permissions, to modify the conditions under which templates are displayed.

NVD CVE-2022-4708 Wordfence advisory Wordfence advisory Plugin source

medium 6.5 CVE-2022-4709 · published 2023-01-10

Missing authorization check in Royal Addons for Elementor (1.3.59 and older)

Affected: 1.3.59 and older
Fixed in: 1.3.60 *
Access needed (per CVSS): Needs a low-level account (e.g. subscriber)
Range from: CVE record (the advisory publisher) · score by NVD

Details from the advisory

The Royal Elementor Addons plugin for WordPress is vulnerable to insufficient access control in the 'wpr_import_library_template' AJAX action in versions up to, and including, 1.3.59. This allows any authenticated user, including those with subscriber-level permissions, to import and activate templates from the plugin's template library.

NVD CVE-2022-4709 Wordfence advisory Wordfence advisory Plugin source

medium 6.1 CVE-2022-4710 · published 2023-01-10

Reflected cross-site scripting (XSS) in Royal Addons for Elementor (1.3.59 and older)

Affected: 1.3.59 and older
Fixed in: 1.3.60 *
Access needed (per CVSS): No login needed; someone on the site has to click a link or open a page
Range from: CVE record (the advisory publisher) · score by NVD

Details from the advisory

The Royal Elementor Addons plugin for WordPress is vulnerable to Reflected Cross-Site Scripting in versions up to, and including, 1.3.59, due to due to insufficient input sanitization and output escaping of the 'wpr_ajax_search_link_target' parameter in the 'data_fetch' function. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link. This is occurring because 'sanitize_text_field' is insufficient to prevent attribute-based Cross-Site Scripting

NVD CVE-2022-4710 Wordfence advisory Wordfence advisory Plugin source

medium 4.3 CVE-2022-4711 · published 2023-01-10

Missing authorization check in Royal Addons for Elementor (1.3.59 and older)

Affected: 1.3.59 and older
Fixed in: 1.3.60 *
Access needed (per CVSS): Needs a low-level account (e.g. subscriber)
Range from: CVE record (the advisory publisher) · score by NVD

Details from the advisory

The Royal Elementor Addons plugin for WordPress is vulnerable to insufficient access control in the 'wpr_save_mega_menu_settings' AJAX action in versions up to, and including, 1.3.59. This allows any authenticated user, including those with subscriber-level permissions, to enable and modify Mega Menu settings for any menu item.

NVD CVE-2022-4711 Wordfence advisory Wordfence advisory Plugin source

Recent activity

2026-10-23 — latest release on wordpress.org (1.7.1070).
2026-10-28 — Cross-site scripting (XSS) disclosed (CVE-2026-107098), fixed in 1.7.1070.
2026-10-28 — Information disclosure disclosed (CVE-2026-107100), fixed in 1.7.1070.
2026-10-28 — Missing authorization check disclosed (CVE-2026-106647), fixed in 1.7.1070.

Free. We check the CVE feeds every day and email you only when a new issue for Royal Addons for Elementor (royal-elementor-addons) is published or a fix ships. Unsubscribe in one click.

Where this data comes from

Version, last update, installs: wordpress.org/plugins/royal-elementor-addons (Plugins API), fetched 2026-11-01.
Vulnerabilities: NIST National Vulnerability Database (NVD), checked 2026-11-01. This product uses data from the NVD API but is not endorsed or certified by the NVD.
Each record links to its CVE page and to the original advisory (Wordfence, Patchstack or WPScan) where there is one. We only list a CVE here when its references or its advisory name this exact plugin, so a few real issues may be missing; none should be about a different plugin. Spot an error? Email Daniel.

Badge for your site or docs (states facts with a date, not a verdict):

<a href="https://laskyr.com/plugins/royal-elementor-addons"><img src="https://laskyr.com/plugins/royal-elementor-addons/badge.svg" alt="Royal Addons for Elementor vulnerability status"></a>

← Check another plugin · Free hacked-site scan