Royal-Elementor-Addons Royal Elementor Addons vulnerabilities

CVE-2025-1456 [MEDIUM] CWE-79 CVE-2025-1456: The Royal Elementor Addons and Templates plugin for WordPress is vulnerable to Stored Cross-Site Scr The Royal Elementor Addons and Templates plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the `widgetGrid`, `widgetCountDown`, and `widgetInstagramFeed` methods in all versions up to, and including, 1.7.1012 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contribu

CVE-2025-39361 [MEDIUM] CWE-79 CVE-2025-39361: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability i Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WP Royal Royal Elementor Addons royal-elementor-addons allows Stored XSS.This issue affects Royal Elementor Addons: from n/a through <= 1.7.1017.

CVE-2024-12120 [MEDIUM] CWE-79 CVE-2024-12120: The Royal Elementor Addons and Templates plugin for WordPress is vulnerable to Stored Cross-Site Scr The Royal Elementor Addons and Templates plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Countdown widget display_message_text parameter in all versions up to, and including, 1.7.1017 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access

CVE-2025-3813 [MEDIUM] CWE-79 CVE-2025-3813: The Royal Elementor Addons and Templates plugin for WordPress is vulnerable to Stored Cross-Site Scr The Royal Elementor Addons and Templates plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘_elementor_data’ parameter in all versions up to, and including, 1.7.1020 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject a

CVE-2025-5338 [MEDIUM] CWE-79 CVE-2025-5338: The Royal Elementor Addons plugin for WordPress is vulnerable to Stored Cross-Site Scripting via mul The Royal Elementor Addons plugin for WordPress is vulnerable to Stored Cross-Site Scripting via multiple widgets in all versions up to, and including, 1.7.1028 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject ar

CVE-2025-26990 [MEDIUM] CWE-918 CVE-2025-26990: Server-Side Request Forgery (SSRF) vulnerability in WP Royal Royal Elementor Addons royal-elementor- Server-Side Request Forgery (SSRF) vulnerability in WP Royal Royal Elementor Addons royal-elementor-addons allows Server Side Request Forgery.This issue affects Royal Elementor Addons: from n/a through <= 1.7.1006.

CVE-2022-4710 [MEDIUM] CWE-79 CVE-2022-4710: The Royal Elementor Addons plugin for WordPress is vulnerable to Reflected Cross-Site Scripting in v The Royal Elementor Addons plugin for WordPress is vulnerable to Reflected Cross-Site Scripting in versions up to, and including, 1.3.59, due to due to insufficient input sanitization and output escaping of the 'wpr_ajax_search_link_target' parameter in the 'data_fetch' function. This makes it possible for unauthenticated attackers to inject arbitrary

CVE-2024-44001 [MEDIUM] CWE-79 CVE-2024-44001: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability i Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WP Royal Royal Elementor Addons royal-elementor-addons.This issue affects Royal Elementor Addons: from n/a through <= 1.3.982.

CVE-2024-56227 [MEDIUM] CWE-862 CVE-2024-56227: Missing Authorization vulnerability in WP Royal Royal Elementor Addons royal-elementor-addons allows Missing Authorization vulnerability in WP Royal Royal Elementor Addons royal-elementor-addons allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Royal Elementor Addons: from n/a through <= 1.7.1001.

CVE-2022-4103 [MEDIUM] CWE-352 CVE-2022-4103: The Royal Elementor Addons WordPress plugin before 1.3.56 does not have authorisation and CSRF check The Royal Elementor Addons WordPress plugin before 1.3.56 does not have authorisation and CSRF checks when creating a template, and does not ensure that the post created is a template. This could allow any authenticated users, such as subscriber to create a post (as well as any post type) with an arbitrary title

CVE-2024-7417 [MEDIUM] CWE-200 CVE-2024-7417: The Royal Elementor Addons and Templates plugin for WordPress is vulnerable to Information Exposure The Royal Elementor Addons and Templates plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 1.3.986 via the data_fetch. This makes it possible for authenticated attackers, with subscriber-level access and above, to extract data from password protected posts.

CVE-2024-10798 [MEDIUM] CWE-639 CVE-2024-10798: The Royal Elementor Addons and Templates plugin for WordPress is vulnerable to Information Exposure The Royal Elementor Addons and Templates plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 1.7.1003 via the 'wpr-template' shortcode due to insufficient restrictions on which posts can be included. This makes it possible for authenticated attackers, with Contributor-level access and above, to extract dat

CVE-2024-0514 [MEDIUM] CWE-352 CVE-2024-0514: The Royal Elementor Addons and Templates plugin for WordPress is vulnerable to Cross-Site Request Fo The Royal Elementor Addons and Templates plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.3.87. This is due to missing or incorrect nonce validation on the add_to_compare function. This makes it possible for unauthenticated attackers to add items to user compare lists via a forged request granted

CVE-2024-0512 [MEDIUM] CWE-352 CVE-2024-0512: The Royal Elementor Addons and Templates plugin for WordPress is vulnerable to Cross-Site Request Fo The Royal Elementor Addons and Templates plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.3.87. This is due to missing or incorrect nonce validation on the add_to_wishlist function. This makes it possible for unauthenticated attackers to add items to user wishlists via a forged request granted th

CVE-2024-0515 [MEDIUM] CWE-352 CVE-2024-0515: The Royal Elementor Addons and Templates plugin for WordPress is vulnerable to Cross-Site Request Fo The Royal Elementor Addons and Templates plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.3.87. This is due to missing or incorrect nonce validation on the remove_from_compare function. This makes it possible for unauthenticated attackers to remove items from user compare lists via a forged reque

CVE-2024-0513 [MEDIUM] CWE-352 CVE-2024-0513: The Royal Elementor Addons and Templates plugin for WordPress is vulnerable to Cross-Site Request Fo The Royal Elementor Addons and Templates plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.3.87. This is due to missing or incorrect nonce validation on the remove_from_wishlist function. This makes it possible for unauthenticated attackers to remove items from user wishlists via a forged request

CVE-2024-0511 [MEDIUM] CWE-352 CVE-2024-0511: The Royal Elementor Addons and Templates plugin for WordPress is vulnerable to Cross-Site Request Fo The Royal Elementor Addons and Templates plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.3.87. This is due to missing or incorrect nonce validation on the wpr_update_form_action_meta function. This makes it possible for unauthenticated attackers to post metadata via a forged request granted they

CVE-2022-4102 [LOW] CWE-352 CVE-2022-4102: The Royal Elementor Addons WordPress plugin before 1.3.56 does not have authorization and CSRF check The Royal Elementor Addons WordPress plugin before 1.3.56 does not have authorization and CSRF checks when deleting a template and does not ensure that the post to be deleted is a template. This could allow any authenticated users, such as subscribers, to delete arbitrary posts assuming they know the related slug.