WProyal Royal Addons for Elementor – Addons and Templates Kit for Elementor

• CVE-2026-17585 Medium 5.3 Royal Addons for Elementor <= 1.7.1066 - Unauthenticated Sensitive Information Exposure via Unfiltered meta_query LIKE Oracle in 'wpr_keyword' Parameter 0.6%
• CVE-2026-17123 High 8.8 Royal Addons for Elementor <= 1.7.1064 - Authenticated (Contributor+) Server-Side Request Forgery via Form Builder Widget 'webhook_url' Setting 0.6%
• CVE-2026-8118 Medium 6.5 Royal Addons for Elementor – Addons and Templates Kit for Elementor 1.7.1058 - 1.7.1059 - Authenticated (Contributor+) Arbitrary File Read via Data Table Widget CSV File Source 0.4%
• CVE-2026-6504 Medium 6.4 Royal Addons for Elementor <= 1.7.1058 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'title_tag' Parameter 0.3%
• CVE-2026-5159 Medium 6.4 Royal Addons for Elementor <= 1.7.1056 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'Follow Button Text' Parameter 0.3%
• CVE-2026-4803 High 7.2 Royal Addons for Elementor <= 1.7.1056 - Unauthenticated Stored Cross-Site Scripting via 'status' Parameter in wpr_update_form_action_meta 0.4%
• CVE-2026-4024 Medium 5.3 Royal Addons for Elementor <= 1.7.1056 - Missing Authorization to Unauthenticated Form Action Meta Modification 0.5%
• CVE-2026-6229 High 7.2 Royal Addons for Elementor <= 1.7.1057 - Authenticated (Contributor+) Server-Side Request Forgery via CSV URL Parameter 0.4%
• CVE-2026-5428 Medium 6.4 Royal Addons for Elementor <= 1.7.1056 - Authenticated (Author+) Stored Cross-Site Scripting via Image Caption Field 0.3%
• CVE-2026-5162 Medium 6.4 Royal Addons for Elementor <= 1.7.1056 - Authenticated (Contributor+) Stored Cross-Site Scripting via Instagram Feed Widget 0.4%
• CVE-2026-0664 Medium 6.4 Royal Elementor Addons <= 1.7.1049 - Authenticated (Contributor+) Stored Cross-Site Scripting via REST API Meta Bypass 0.3%
• CVE-2026-2373 Medium 5.3 Royal Addons for Elementor – Addons and Templates Kit for Elementor <= 1.7.1049 - Missing Authorization to Unauthenticated Custom Post Type Contents Exposure 0.2%
• CVE-2025-13067 High 8.8 Royal Addons for Elementor <= 1.7.1049 - Authenticated (Author+) Arbitrary File Upload via main.php Upload Bypass 0.5%
• CVE-2025-5092 Medium 6.4 Multiple Plugins and Themes <= (Various Versions) - Authenticated (Contributor+) DOM-Based Stored Cross-Site Scripting via lightGallery JavaScript Library 0.3%
• CVE-2025-6251 Medium 6.4 Royal Elementor Addons and Templates <= 1.7.1036 - Authenticated (Contributor+) Stored Cross-Site Scripting 0.2%
• CVE-2025-5338 Medium 6.4 Royal Elementor Addons <= 1.7.1028 - Authenticated (Contributor+) Stored DOM-Based Cross-Site Scripting via Multiple Widgets 0.3%
• CVE-2025-3813 Medium 6.4 Royal Elementor Addons and Templates <= 1.7.1020 - Authenticated (Contributor+) Stored Cross-Site Scripting 0.3%
• CVE-2024-12120 Medium 5.4 Royal Elementor Addons and Templates <= 1.7.1017 - Authenticated (Contributor+) Stored Cross-Site Scripting 0.3%
• CVE-2025-1456 Medium 6.4 Royal Elementor Addons and Templates <= 1.7.1012 - Authenticated DOM-Based (Contributor+) Stored Cross-Site Scripting 0.3%
• CVE-2025-1455 Medium 6.4 Royal Elementor Addons and Templates <= 1.7.1012 - Authenticated (Contributor+) Stored Cross-Site Scripting 0.3%
• CVE-2025-1441 Medium 6.1 Royal Elementor Addons and Templates <= 1.7.1007 - Cross-Site Request Forgery to Reflected Cross-Site Scripting 0.2%
• CVE-2025-0393 Medium 6.1 Royal Elementor Addons and Templates <= 1.7.1006 - Cross-Site Request Forgery to Reflected Cross-Site Scripting 0.2%
• CVE-2024-10798 Medium 4.3 Royal Elementor Addons and Templates <= 1.7.1003 - Authenticated (Contributor+) Post Disclosure 0.4%
• CVE-2024-9682 Medium 6.4 Royal Elementor Addons and Templates <= 1.7.1001 - Authenticated (Contributor+) DOM-Based Stored Cross-Site Scripting via Form Builder Widget 0.4%
• CVE-2024-9668 Medium 6.4 Royal Elementor Addons and Templates <= 1.7.1001 - Authenticated (Contributor+) Stored Cross-Site Scripting via Countdown Widget 0.4%
• CVE-2024-9059 Medium 6.4 Royal Elementor Addons and Template <= 1.7.1001 - Authenticated (Contributor+) DOM-Based Stored Cross-Site Scripting via Google Maps Widget 0.4%
• CVE-2024-7417 Medium 4.3 Royal Elementor Addons and Templates <= 1.3.986 - Authenticated (Subscriber+) Private Post Disclosure 0.4%
• CVE-2024-8482 Medium 6.4 Royal Elementor Addons and Templates <= 1.3.986 - Authenticated (Contributor+) Stored Cross-Site Scripting via Team Member Widget 0.4%
• CVE-2024-5818 Medium 6.4 Royal Elementor Addons and Templates <= 1.3.980 - Authenticated (Contributor+) DOM-Based Stored Cross-Site Scripting via Magazine Grid/Slider Widget 0.3%
• CVE-2024-4488 Medium 6.4 Royal Elementor Addons and Templates <= 1.3.976 - Authenticated (Contributor+) Stored Cross-Site Scripting 0.3%
• CVE-2024-4489 Medium 6.4 Royal Elementor Addons and Templates <= 1.3.976 - Authenticated (Author+) Stored Cross-Site Scripting via SVG Uploads 0.3%
• CVE-2024-4087 Medium 6.4 Royal Elementor Addons and Templates <= 1.3.975 - Authenticated (Contributor+) Stored Cross-Site Scripting via Back to Top Widget 0.3%
• CVE-2024-4342 Medium 6.4 Royal Elementor Addons and Templates <= 1.3.975 - Authenticated (Contributor+) Stored Cross-Site Scripting 0.3%
• CVE-2024-3887 Medium 5.4 Royal Elementor Addons and Templates <= 1.3.974 - Authenticated (Contributor+) Stored Cross-Site Scripting via Form Builder Widget 0.3%
• CVE-2024-1567 High 8.2 Royal Elementor Addons and Templates <= 1.3.94 - Unauthenticated Limited File Upload 1.1%
• CVE-2024-3675 Medium 6.4 Royal Elementor Addons and Templates <= 1.3.971 - Authenticated (Contributor+) Stored Cross-Site Scripting via Flip Carousel, Flip Box, Post Grid, and Taxonomy List Widget Attributes 0.6%
• CVE-2024-3889 Medium 6.4 Royal Elementor Addons and Templates <= 1.3.971 - Authenticated (Contributor+) Stored Cross-Site Scripting via Advanced Accordion Title Tags 0.3%
• CVE-2024-2798 Medium 6.4 Royal Elementor Addons and Templates <= 1.3.971 - Authenticated (Contributor+) DOM-Based Stored Cross-Site Scripting 0.3%
• CVE-2024-2799 Medium 6.4 Royal Elementor Addons and Templates <= 1.3.971 - Authenticated (Contributor+) Stored Cross-Site Scripting via HTML Tags 0.4%
• CVE-2024-1500 Medium 5.4 Royal Elementor Addons and Templates <= 1.3.91 - Authenticated (Contributor+) Stored Cross-Site Scripting via Logo Widget 0.4%
• CVE-2024-0516 Medium 5.3 Royal Elementor Addons and Templates <= 1.3.87 - Missing Authorization via wpr_update_form_action_meta 0.2%
• CVE-2024-0512 Medium 4.3 Royal Elementor Addons and Templates <= 1.3.87 - Cross-Site Request Forgery via add_to_wishlist 0.2%
• CVE-2024-0514 Medium 4.3 Royal Elementor Addons and Templates <= 1.3.87 - Cross-Site Request Forgery via add_to_compare 0.2%
• CVE-2024-0515 Medium 4.3 Royal Elementor Addons and Templates <= 1.3.87 - Cross-Site Request Forgery via remove_from_compare 0.2%
• CVE-2024-0513 Medium 4.3 Royal Elementor Addons and Templates <= 1.3.87 - Cross-Site Request Forgery via remove_from_wishlist 0.2%
• CVE-2024-0442 Medium 6.4 Royal Elementor Addons and Templates <= 1.3.87 - Authenticated (Contributor+) Stored Cross-Site Scripting 0.5%
• CVE-2024-0511 Medium 4.3 Royal Elementor Addons and Templates <= 1.3.87 - Cross-Site Request Forgery via wpr_update_form_action_meta 0.2%
• CVE-2023-3709 Medium 5.3 Royal Elementor Addons <=1.3.70 - Unauthenticated MailChimp API Key Disclosure 0.6%
• CVE-2022-4707 Medium 4.3 Royal Elementor Addons <= 1.3.59 - Cross-Site Request Forgery to Menu Template creation 0.4%
• CVE-2022-4701 Medium 4.3 Royal Elementor Addons <= 1.3.59 - Insufficient Access Control to Plugin Activation 0.8%