What’s Vulnerable › Products
wproyal Royal Addons for Elementor – Addons and Templates Kit for Elementor vulnerabilities
83 known vulnerabilities, 0 confirmed exploited in the wild (CISA KEV), 32 published in the last 12 months.
Latest wproyal Royal Addons for Elementor – Addons and Templates Kit for Elementor vulnerabilities
- CVE-2026-97255 — WordPress Royal Elementor Addons plugin <= 1.7.1069 - Insecure Direct Object References (IDOR) vulnerability (CVSS 5.3)
- CVE-2026-97254 — WordPress Royal Elementor Addons plugin <= 1.7.1069 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5)
- CVE-2026-112865 — WordPress Royal Elementor Addons plugin <= 1.7.1069 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5)
- CVE-2026-111851 — WordPress Royal Elementor Addons plugin <= 1.7.1068 - Arbitrary Code Execution vulnerability (CVSS 7.6)
- CVE-2026-17585 — Royal Addons for Elementor <= 1.7.1066 - Unauthenticated Sensitive Information Exposure via Unfiltered meta_query LIKE Oracle in 'wpr_keyword' Parameter (CVSS 5.3)
- CVE-2026-17123 — Royal Addons for Elementor <= 1.7.1064 - Authenticated (Contributor+) Server-Side Request Forgery via Form Builder Widget 'webhook_url' Setting (CVSS 8.8)
- CVE-2026-8118 — Royal Addons for Elementor – Addons and Templates Kit for Elementor 1.7.1058 - 1.7.1059 - Authenticated (Contributor+) Arbitrary File Read via Data Table Widget CSV File Source (CVSS 6.5)
- CVE-2026-6504 — Royal Addons for Elementor <= 1.7.1058 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'title_tag' Parameter (CVSS 6.4)
- CVE-2026-27421 — WordPress Royal Elementor Addons plugin < 1.7.1053 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5)
- CVE-2026-25436 — WordPress Royal Elementor Addons plugin < 1.7.1053 - Broken Access Control vulnerability (CVSS 5.3)
- CVE-2026-5159 — Royal Addons for Elementor <= 1.7.1056 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'Follow Button Text' Parameter (CVSS 6.4)
- CVE-2026-4803 — Royal Addons for Elementor <= 1.7.1056 - Unauthenticated Stored Cross-Site Scripting via 'status' Parameter in wpr_update_form_action_meta (CVSS 7.2)
- CVE-2026-4024 — Royal Addons for Elementor <= 1.7.1056 - Missing Authorization to Unauthenticated Form Action Meta Modification (CVSS 5.3)
- CVE-2026-6229 — Royal Addons for Elementor <= 1.7.1057 - Authenticated (Contributor+) Server-Side Request Forgery via CSV URL Parameter (CVSS 7.2)
- CVE-2026-5428 — Royal Addons for Elementor <= 1.7.1056 - Authenticated (Author+) Stored Cross-Site Scripting via Image Caption Field (CVSS 6.4)
- CVE-2026-5162 — Royal Addons for Elementor <= 1.7.1056 - Authenticated (Contributor+) Stored Cross-Site Scripting via Instagram Feed Widget (CVSS 6.4)
- CVE-2026-40763 — WordPress Royal Elementor Addons plugin <= 1.7.1056 - Broken Access Control vulnerability (CVSS 5.3)
- CVE-2026-0664 — Royal Elementor Addons <= 1.7.1049 - Authenticated (Contributor+) Stored Cross-Site Scripting via REST API Meta Bypass (CVSS 6.4)
- CVE-2026-2373 — Royal Addons for Elementor – Addons and Templates Kit for Elementor <= 1.7.1049 - Missing Authorization to Unauthenticated Custom Post Type Contents Exposure (CVSS 5.3)
- CVE-2025-13067 — Royal Addons for Elementor <= 1.7.1049 - Authenticated (Author+) Arbitrary File Upload via main.php Upload Bypass (CVSS 8.8)
- CVE-2026-28135 — WordPress Royal Elementor Addons plugin <= 1.7.1052 - Other vulnerability Type vulnerability (CVSS 8.2)
- CVE-2025-5092 — Multiple Plugins and Themes <= (Various Versions) - Authenticated (Contributor+) DOM-Based Stored Cross-Site Scripting via lightGallery JavaScript Library (CVSS 6.4)
- CVE-2025-6251 — Royal Elementor Addons and Templates <= 1.7.1036 - Authenticated (Contributor+) Stored Cross-Site Scripting (CVSS 6.4)
- CVE-2025-5338 — Royal Elementor Addons <= 1.7.1028 - Authenticated (Contributor+) Stored DOM-Based Cross-Site Scripting via Multiple Widgets (CVSS 5.4)
- CVE-2025-3813 — Royal Elementor Addons and Templates <= 1.7.1020 - Authenticated (Contributor+) Stored Cross-Site Scripting (CVSS 5.4)