Advisories · Technology

wproyal Royal Addons for Elementor – Addons and Templates Kit for Elementor.

Every CVE that names wproyal Royal Addons for Elementor – Addons and Templates Kit for Elementor among its affected products, newest first. Vendors and products are as the CNA wrote them; check the affected versions on each record.

CVE-2026-17585 CVE record

CVSS 5.3 Medium

Royal Addons for Elementor <= 1.7.1066 - Unauthenticated Sensitive Information Exposure via Unfiltered meta_query LIKE Oracle in 'wpr_keyword' Parameter
- wproyal Royal Addons for Elementor – Addons and Templates Kit for Elementor
- Information disclosure
Not analysed yet 12 Sept 2026
CVE-2026-17123 CVE record

CVSS 8.8 High

Royal Addons for Elementor <= 1.7.1064 - Authenticated (Contributor+) Server-Side Request Forgery via Form Builder Widget 'webhook_url' Setting
- wproyal Royal Addons for Elementor – Addons and Templates Kit for Elementor
- Server-side request forgery (SSRF)
Not analysed yet 16 Aug 2026
CVE-2026-8118 CVE record

CVSS 6.5 Medium

Royal Addons for Elementor – Addons and Templates Kit for Elementor 1.7.1058 - 1.7.1059 - Authenticated (Contributor+) Arbitrary File Read via Data Table Widget CSV File Source
- wproyal Royal Addons for Elementor – Addons and Templates Kit for Elementor
- Path traversal
Not analysed yet 19 Jun 2026
CVE-2026-6504 CVE record

CVSS 6.4 Medium

Royal Addons for Elementor <= 1.7.1058 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'title_tag' Parameter
- wproyal Royal Addons for Elementor – Addons and Templates Kit for Elementor
- Cross-site scripting (XSS)
Not analysed yet 14 May 2026
CVE-2026-5159 CVE record

CVSS 6.4 Medium

Royal Addons for Elementor <= 1.7.1056 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'Follow Button Text' Parameter
- wproyal Royal Addons for Elementor – Addons and Templates Kit for Elementor
- Cross-site scripting (XSS)
Not analysed yet 5 May 2026
CVE-2026-4803 CVE record

CVSS 7.2 High

Royal Addons for Elementor <= 1.7.1056 - Unauthenticated Stored Cross-Site Scripting via 'status' Parameter in wpr_update_form_action_meta
- wproyal Royal Addons for Elementor – Addons and Templates Kit for Elementor
- Cross-site scripting (XSS)
Not analysed yet 5 May 2026
CVE-2026-4024 CVE record

CVSS 5.3 Medium

Royal Addons for Elementor <= 1.7.1056 - Missing Authorization to Unauthenticated Form Action Meta Modification
- wproyal Royal Addons for Elementor – Addons and Templates Kit for Elementor
- Broken access control
Not analysed yet 2 May 2026
CVE-2026-6229 CVE record

CVSS 7.2 High

Royal Addons for Elementor <= 1.7.1057 - Authenticated (Contributor+) Server-Side Request Forgery via CSV URL Parameter
- wproyal Royal Addons for Elementor – Addons and Templates Kit for Elementor
- Server-side request forgery (SSRF)
Not analysed yet 2 May 2026
CVE-2026-5428 CVE record

CVSS 6.4 Medium

Royal Addons for Elementor <= 1.7.1056 - Authenticated (Author+) Stored Cross-Site Scripting via Image Caption Field
- wproyal Royal Addons for Elementor – Addons and Templates Kit for Elementor
- Cross-site scripting (XSS)
Not analysed yet 24 Apr 2026
CVE-2026-5162 CVE record

CVSS 6.4 Medium

Royal Addons for Elementor <= 1.7.1056 - Authenticated (Contributor+) Stored Cross-Site Scripting via Instagram Feed Widget
- wproyal Royal Addons for Elementor – Addons and Templates Kit for Elementor
- Cross-site scripting (XSS)
Not analysed yet 17 Apr 2026
CVE-2026-0664 CVE record

CVSS 6.4 Medium

Royal Elementor Addons <= 1.7.1049 - Authenticated (Contributor+) Stored Cross-Site Scripting via REST API Meta Bypass
- wproyal Royal Addons for Elementor – Addons and Templates Kit for Elementor
- Cross-site scripting (XSS)
Not analysed yet 4 Apr 2026
CVE-2026-2373 CVE record

CVSS 5.3 Medium

Royal Addons for Elementor – Addons and Templates Kit for Elementor <= 1.7.1049 - Missing Authorization to Unauthenticated Custom Post Type Contents Exposure
- wproyal Royal Addons for Elementor – Addons and Templates Kit for Elementor
- Broken access control
Not analysed yet 17 Mar 2026
CVE-2025-13067 CVE record

CVSS 8.8 High

Royal Addons for Elementor <= 1.7.1049 - Authenticated (Author+) Arbitrary File Upload via main.php Upload Bypass
- wproyal Royal Addons for Elementor – Addons and Templates Kit for Elementor
- Unrestricted file upload
Not analysed yet 11 Mar 2026
CVE-2025-5092 CVE record

CVSS 6.4 Medium

Multiple Plugins and Themes <= (Various Versions) - Authenticated (Contributor+) DOM-Based Stored Cross-Site Scripting via lightGallery JavaScript Library
- lightgalleryteam LightGallery WP
- tplugins TP WooCommerce Product Gallery
- Cross-site scripting (XSS)
Not analysed yet 20 Nov 2025
CVE-2025-6251 CVE record

CVSS 6.4 Medium

Royal Elementor Addons and Templates <= 1.7.1036 - Authenticated (Contributor+) Stored Cross-Site Scripting
- wproyal Royal Addons for Elementor – Addons and Templates Kit for Elementor
- Cross-site scripting (XSS)
Not analysed yet 19 Nov 2025
CVE-2025-5338 CVE record

CVSS 6.4 Medium

Royal Elementor Addons <= 1.7.1028 - Authenticated (Contributor+) Stored DOM-Based Cross-Site Scripting via Multiple Widgets
- wproyal Royal Addons for Elementor – Addons and Templates Kit for Elementor
- Cross-site scripting (XSS)
Not analysed yet 26 Jun 2025
CVE-2025-3813 CVE record

CVSS 6.4 Medium

Royal Elementor Addons and Templates <= 1.7.1020 - Authenticated (Contributor+) Stored Cross-Site Scripting
- wproyal Royal Addons for Elementor – Addons and Templates Kit for Elementor
- Cross-site scripting (XSS)
Not analysed yet 31 May 2025
CVE-2024-12120 CVE record

CVSS 5.4 Medium

Royal Elementor Addons and Templates <= 1.7.1017 - Authenticated (Contributor+) Stored Cross-Site Scripting
- wproyal Royal Addons for Elementor – Addons and Templates Kit for Elementor
- Cross-site scripting (XSS)
Not analysed yet 7 May 2025
CVE-2025-1456 CVE record

CVSS 6.4 Medium

Royal Elementor Addons and Templates <= 1.7.1012 - Authenticated DOM-Based (Contributor+) Stored Cross-Site Scripting
- wproyal Royal Addons for Elementor – Addons and Templates Kit for Elementor
- Cross-site scripting (XSS)
Not analysed yet 12 Apr 2025
CVE-2025-1455 CVE record

CVSS 6.4 Medium

Royal Elementor Addons and Templates <= 1.7.1012 - Authenticated (Contributor+) Stored Cross-Site Scripting
- wproyal Royal Addons for Elementor – Addons and Templates Kit for Elementor
- Cross-site scripting (XSS)
Not analysed yet 12 Apr 2025
CVE-2025-1441 CVE record

CVSS 6.1 Medium

Royal Elementor Addons and Templates <= 1.7.1007 - Cross-Site Request Forgery to Reflected Cross-Site Scripting
- wproyal Royal Addons for Elementor – Addons and Templates Kit for Elementor
- Cross-site request forgery (CSRF)
Not analysed yet 19 Feb 2025
CVE-2025-0393 CVE record

CVSS 6.1 Medium

Royal Elementor Addons and Templates <= 1.7.1006 - Cross-Site Request Forgery to Reflected Cross-Site Scripting
- wproyal Royal Addons for Elementor – Addons and Templates Kit for Elementor
- Cross-site request forgery (CSRF)
Not analysed yet 14 Jan 2025
CVE-2024-10798 CVE record

CVSS 4.3 Medium

Royal Elementor Addons and Templates <= 1.7.1003 - Authenticated (Contributor+) Post Disclosure
- wproyal Royal Addons for Elementor – Addons and Templates Kit for Elementor
- Broken access control
Not analysed yet 28 Nov 2024
CVE-2024-9682 CVE record

CVSS 6.4 Medium

Royal Elementor Addons and Templates <= 1.7.1001 - Authenticated (Contributor+) DOM-Based Stored Cross-Site Scripting via Form Builder Widget
- wproyal Royal Addons for Elementor – Addons and Templates Kit for Elementor
- Cross-site scripting (XSS)
Not analysed yet 13 Nov 2024
CVE-2024-9668 CVE record

CVSS 6.4 Medium

Royal Elementor Addons and Templates <= 1.7.1001 - Authenticated (Contributor+) Stored Cross-Site Scripting via Countdown Widget
- wproyal Royal Addons for Elementor – Addons and Templates Kit for Elementor
- Cross-site scripting (XSS)
Not analysed yet 13 Nov 2024
CVE-2024-9059 CVE record

CVSS 6.4 Medium

Royal Elementor Addons and Template <= 1.7.1001 - Authenticated (Contributor+) DOM-Based Stored Cross-Site Scripting via Google Maps Widget
- wproyal Royal Addons for Elementor – Addons and Templates Kit for Elementor
- Cross-site scripting (XSS)
Not analysed yet 13 Nov 2024
CVE-2024-7417 CVE record

CVSS 4.3 Medium

Royal Elementor Addons and Templates <= 1.3.986 - Authenticated (Subscriber+) Private Post Disclosure
- wproyal Royal Addons for Elementor – Addons and Templates Kit for Elementor
- Information disclosure
Not analysed yet 17 Oct 2024
CVE-2024-8482 CVE record

CVSS 6.4 Medium

Royal Elementor Addons and Templates <= 1.3.986 - Authenticated (Contributor+) Stored Cross-Site Scripting via Team Member Widget
- wproyal Royal Addons for Elementor – Addons and Templates Kit for Elementor
- Cross-site scripting (XSS)
Not analysed yet 8 Oct 2024
CVE-2024-5818 CVE record

CVSS 6.4 Medium

Royal Elementor Addons and Templates <= 1.3.980 - Authenticated (Contributor+) DOM-Based Stored Cross-Site Scripting via Magazine Grid/Slider Widget
- wproyal Royal Addons for Elementor – Addons and Templates Kit for Elementor
- Cross-site scripting (XSS)
Not analysed yet 24 Jul 2024
CVE-2024-4488 CVE record

CVSS 6.4 Medium

Royal Elementor Addons and Templates <= 1.3.976 - Authenticated (Contributor+) Stored Cross-Site Scripting
- wproyal Royal Addons for Elementor – Addons and Templates Kit for Elementor
- Cross-site scripting (XSS)
Not analysed yet 7 Jun 2024
CVE-2024-4489 CVE record

CVSS 6.4 Medium

Royal Elementor Addons and Templates <= 1.3.976 - Authenticated (Author+) Stored Cross-Site Scripting via SVG Uploads
- wproyal Royal Addons for Elementor – Addons and Templates Kit for Elementor
- Cross-site scripting (XSS)
Not analysed yet 7 Jun 2024
CVE-2024-4087 CVE record

CVSS 6.4 Medium

Royal Elementor Addons and Templates <= 1.3.975 - Authenticated (Contributor+) Stored Cross-Site Scripting via Back to Top Widget
- wproyal Royal Addons for Elementor – Addons and Templates Kit for Elementor
- Cross-site scripting (XSS)
Not analysed yet 1 Jun 2024
CVE-2024-4342 CVE record

CVSS 6.4 Medium

Royal Elementor Addons and Templates <= 1.3.975 - Authenticated (Contributor+) Stored Cross-Site Scripting
- wproyal Royal Addons for Elementor – Addons and Templates Kit for Elementor
- Cross-site scripting (XSS)
Not analysed yet 1 Jun 2024
CVE-2024-3887 CVE record

CVSS 5.4 Medium

Royal Elementor Addons and Templates <= 1.3.974 - Authenticated (Contributor+) Stored Cross-Site Scripting via Form Builder Widget
- wproyal Royal Addons for Elementor – Addons and Templates Kit for Elementor
- Cross-site scripting (XSS)
Not analysed yet 16 May 2024
CVE-2024-1567 CVE record

CVSS 8.2 High

Royal Elementor Addons and Templates <= 1.3.94 - Unauthenticated Limited File Upload
- wproyal Royal Addons for Elementor – Addons and Templates Kit for Elementor
- Unrestricted file upload
Not analysed yet 2 May 2024
CVE-2024-3675 CVE record

CVSS 6.4 Medium

Royal Elementor Addons and Templates <= 1.3.971 - Authenticated (Contributor+) Stored Cross-Site Scripting via Flip Carousel, Flip Box, Post Grid, and Taxonomy List Widget Attributes
- wproyal Royal Addons for Elementor – Addons and Templates Kit for Elementor
- Cross-site scripting (XSS)
Not analysed yet 2 May 2024
CVE-2024-3889 CVE record

CVSS 6.4 Medium

Royal Elementor Addons and Templates <= 1.3.971 - Authenticated (Contributor+) Stored Cross-Site Scripting via Advanced Accordion Title Tags
- wproyal Royal Addons for Elementor – Addons and Templates Kit for Elementor
- Cross-site scripting (XSS)
Not analysed yet 23 Apr 2024
CVE-2024-2798 CVE record

CVSS 6.4 Medium

Royal Elementor Addons and Templates <= 1.3.971 - Authenticated (Contributor+) DOM-Based Stored Cross-Site Scripting
- wproyal Royal Addons for Elementor – Addons and Templates Kit for Elementor
- Cross-site scripting (XSS)
Not analysed yet 23 Apr 2024
CVE-2024-2799 CVE record

CVSS 6.4 Medium

Royal Elementor Addons and Templates <= 1.3.971 - Authenticated (Contributor+) Stored Cross-Site Scripting via HTML Tags
- wproyal Royal Addons for Elementor – Addons and Templates Kit for Elementor
- Cross-site scripting (XSS)
Not analysed yet 23 Apr 2024
CVE-2024-1500 CVE record

CVSS 5.4 Medium

Royal Elementor Addons and Templates <= 1.3.91 - Authenticated (Contributor+) Stored Cross-Site Scripting via Logo Widget
- wproyal Royal Addons for Elementor – Addons and Templates Kit for Elementor
- Cross-site scripting (XSS)
Not analysed yet 7 Mar 2024
CVE-2024-0516 CVE record

CVSS 5.3 Medium

Royal Elementor Addons and Templates <= 1.3.87 - Missing Authorization via wpr_update_form_action_meta
- wproyal Royal Addons for Elementor – Addons and Templates Kit for Elementor
- Cross-site request forgery (CSRF)
Not analysed yet 20 Feb 2024
CVE-2024-0512 CVE record

CVSS 4.3 Medium

Royal Elementor Addons and Templates <= 1.3.87 - Cross-Site Request Forgery via add_to_wishlist
- wproyal Royal Addons for Elementor – Addons and Templates Kit for Elementor
- Cross-site request forgery (CSRF)
Not analysed yet 20 Feb 2024
CVE-2024-0514 CVE record

CVSS 4.3 Medium

Royal Elementor Addons and Templates <= 1.3.87 - Cross-Site Request Forgery via add_to_compare
- wproyal Royal Addons for Elementor – Addons and Templates Kit for Elementor
- Cross-site request forgery (CSRF)
Not analysed yet 20 Feb 2024
CVE-2024-0515 CVE record

CVSS 4.3 Medium

Royal Elementor Addons and Templates <= 1.3.87 - Cross-Site Request Forgery via remove_from_compare
- wproyal Royal Addons for Elementor – Addons and Templates Kit for Elementor
- Cross-site request forgery (CSRF)
Not analysed yet 20 Feb 2024
CVE-2024-0513 CVE record

CVSS 4.3 Medium

Royal Elementor Addons and Templates <= 1.3.87 - Cross-Site Request Forgery via remove_from_wishlist
- wproyal Royal Addons for Elementor – Addons and Templates Kit for Elementor
- Cross-site request forgery (CSRF)
Not analysed yet 20 Feb 2024
CVE-2024-0442 CVE record

CVSS 6.4 Medium

Royal Elementor Addons and Templates <= 1.3.87 - Authenticated (Contributor+) Stored Cross-Site Scripting
- wproyal Royal Addons for Elementor – Addons and Templates Kit for Elementor
- Cross-site scripting (XSS)
Not analysed yet 20 Feb 2024
CVE-2024-0511 CVE record

CVSS 4.3 Medium

Royal Elementor Addons and Templates <= 1.3.87 - Cross-Site Request Forgery via wpr_update_form_action_meta
- wproyal Royal Addons for Elementor – Addons and Templates Kit for Elementor
- Cross-site request forgery (CSRF)
Not analysed yet 8 Feb 2024
CVE-2023-3709 CVE record

CVSS 5.3 Medium

Royal Elementor Addons <=1.3.70 - Unauthenticated MailChimp API Key Disclosure
- wproyal Royal Addons for Elementor – Addons and Templates Kit for Elementor
- Information disclosure
Not analysed yet 18 Jul 2023
CVE-2022-4707 CVE record

CVSS 4.3 Medium

Royal Elementor Addons <= 1.3.59 - Cross-Site Request Forgery to Menu Template creation
- wproyal Royal Addons for Elementor – Addons and Templates Kit for Elementor
- Cross-site request forgery (CSRF)
Not analysed yet 10 Jan 2023
CVE-2022-4701 CVE record

CVSS 4.3 Medium

Royal Elementor Addons <= 1.3.59 - Insufficient Access Control to Plugin Activation
- wproyal Royal Addons for Elementor – Addons and Templates Kit for Elementor
- Broken access control
Not analysed yet 10 Jan 2023
CVE-2022-4703 CVE record

CVSS 4.3 Medium

Royal Elementor Addons <= 1.3.59 - Insufficient Access Control to Import Deletion
- wproyal Royal Addons for Elementor – Addons and Templates Kit for Elementor
- Broken access control
Not analysed yet 10 Jan 2023
CVE-2022-4705 CVE record

CVSS 4.3 Medium

Royal Elementor Addons <= 1.3.59 - Insufficient Access Control to Template Activation
- wproyal Royal Addons for Elementor – Addons and Templates Kit for Elementor
- Broken access control
Not analysed yet 10 Jan 2023
CVE-2022-4704 CVE record

CVSS 5.4 Medium

Royal Elementor Addons <= 1.3.59 - Insufficient Access Control to Template Import
- wproyal Royal Addons for Elementor – Addons and Templates Kit for Elementor
- Broken access control
Not analysed yet 10 Jan 2023
CVE-2022-4710 CVE record

CVSS 6.1 Medium

Royal Elementor Addons <= 1.3.59 - Reflected Cross-Site Scripting
- wproyal Royal Addons for Elementor – Addons and Templates Kit for Elementor
- Cross-site scripting (XSS)
Not analysed yet 10 Jan 2023
CVE-2022-4708 CVE record

CVSS 4.3 Medium

Royal Elementor Addons <= 1.3.59 - Insufficient Access Control to Template Conditions Modification
- wproyal Royal Addons for Elementor – Addons and Templates Kit for Elementor
- Broken access control
Not analysed yet 10 Jan 2023
CVE-2022-4711 CVE record

CVSS 4.3 Medium

Royal Elementor Addons <= 1.3.59 - Insufficient Access Control to Menu Settings Update
- wproyal Royal Addons for Elementor – Addons and Templates Kit for Elementor
- Broken access control
Not analysed yet 10 Jan 2023
CVE-2022-4702 CVE record

CVSS 5.4 Medium

Royal Elementor Addons <= 1.3.59 - Insufficient Access Control to Plugin Deactivation
- wproyal Royal Addons for Elementor – Addons and Templates Kit for Elementor
- Broken access control
Not analysed yet 10 Jan 2023
CVE-2022-4700 CVE record

CVSS 5.4 Medium

Royal Elementor Addons <= 1.3.59 - Insufficient Access Control to Theme Activation
- wproyal Royal Addons for Elementor – Addons and Templates Kit for Elementor
- Broken access control
Not analysed yet 10 Jan 2023
CVE-2022-4709 CVE record

CVSS 4.3 Medium

Royal Elementor Addons <= 1.3.59 - Insufficient Access Control to Template Kit Import
- wproyal Royal Addons for Elementor – Addons and Templates Kit for Elementor
- Broken access control
Not analysed yet 10 Jan 2023