Log in Start free

WProyal

Products

ProductCVEsExploitedLatest
Royal Addons for Elementor – Addons and Templates Kit for Elementor59–Sep 12, 2026
Royal Elementor Addons7–Nov 6, 2026
Ashe3–Apr 8, 2026
Bard3–Jan 22, 2026
News Magazine X2–Mar 25, 2026
Bard Extra1–Nov 21, 2024
Royal Elementor Kit1–Feb 5, 2024
Royal WordPress Backup, Restore & Migration Plugin – Backup WordPress Sites Safely1–Apr 10, 2026

Exploited and recent CVEs

  • CVE-2026-119519 Medium 4.3 WordPress Royal Elementor Addons plugin <= 1.7.1068 - Broken Access Control vulnerability –
  • CVE-2026-97255 Medium 5.3 WordPress Royal Elementor Addons plugin <= 1.7.1069 - Insecure Direct Object References (IDOR) vulnerability 0.3%
  • CVE-2026-97254 Medium 6.5 WordPress Royal Elementor Addons plugin <= 1.7.1069 - Cross Site Scripting (XSS) vulnerability 0.2%
  • CVE-2026-112865 Medium 6.5 WordPress Royal Elementor Addons plugin <= 1.7.1069 - Cross Site Scripting (XSS) vulnerability 0.2%
  • CVE-2026-111851 High 7.6 WordPress Royal Elementor Addons plugin <= 1.7.1068 - Arbitrary Code Execution vulnerability 0.3%
  • CVE-2026-17585 Medium 5.3 Royal Addons for Elementor <= 1.7.1066 - Unauthenticated Sensitive Information Exposure via Unfiltered meta_query LIKE Oracle in 'wpr_keyword' Parameter 0.6%
  • CVE-2026-17123 High 8.8 Royal Addons for Elementor <= 1.7.1064 - Authenticated (Contributor+) Server-Side Request Forgery via Form Builder Widget 'webhook_url' Setting 0.6%
  • CVE-2026-8118 Medium 6.5 Royal Addons for Elementor – Addons and Templates Kit for Elementor 1.7.1058 - 1.7.1059 - Authenticated (Contributor+) Arbitrary File Read via Data Table Widget CSV File Source 0.4%
  • CVE-2026-6504 Medium 6.4 Royal Addons for Elementor <= 1.7.1058 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'title_tag' Parameter 0.3%
  • CVE-2026-25436 Medium 5.3 WordPress Royal Elementor Addons plugin < 1.7.1053 - Broken Access Control vulnerability 0.2%
  • CVE-2026-27421 Medium 6.5 WordPress Royal Elementor Addons plugin < 1.7.1053 - Cross Site Scripting (XSS) vulnerability 0.2%
  • CVE-2026-5159 Medium 6.4 Royal Addons for Elementor <= 1.7.1056 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'Follow Button Text' Parameter 0.3%
  • CVE-2026-4803 High 7.2 Royal Addons for Elementor <= 1.7.1056 - Unauthenticated Stored Cross-Site Scripting via 'status' Parameter in wpr_update_form_action_meta 0.4%
  • CVE-2026-4024 Medium 5.3 Royal Addons for Elementor <= 1.7.1056 - Missing Authorization to Unauthenticated Form Action Meta Modification 0.5%
  • CVE-2026-6229 High 7.2 Royal Addons for Elementor <= 1.7.1057 - Authenticated (Contributor+) Server-Side Request Forgery via CSV URL Parameter 0.4%
  • CVE-2026-5428 Medium 6.4 Royal Addons for Elementor <= 1.7.1056 - Authenticated (Author+) Stored Cross-Site Scripting via Image Caption Field 0.3%
  • CVE-2026-5162 Medium 6.4 Royal Addons for Elementor <= 1.7.1056 - Authenticated (Contributor+) Stored Cross-Site Scripting via Instagram Feed Widget 0.4%
  • CVE-2026-4305 Medium 6.1 Royal WordPress Backup & Restore Plugin <= 1.0.16 - Reflected Cross-Site Scripting via 'wpr_pending_template' Parameter 0.3%
  • CVE-2026-39627 Medium 4.3 WordPress Ashe theme <= 2.266 - Broken Access Control vulnerability 0.2%
  • CVE-2026-0664 Medium 6.4 Royal Elementor Addons <= 1.7.1049 - Authenticated (Contributor+) Stored Cross-Site Scripting via REST API Meta Bypass 0.3%
  • CVE-2026-24382 High 7.5 WordPress News Magazine X theme <= 1.2.50 - Broken Access Control vulnerability 0.3%
  • CVE-2026-2373 Medium 5.3 Royal Addons for Elementor – Addons and Templates Kit for Elementor <= 1.7.1049 - Missing Authorization to Unauthenticated Custom Post Type Contents Exposure 0.2%
  • CVE-2025-13067 High 8.8 Royal Addons for Elementor <= 1.7.1049 - Authenticated (Author+) Arbitrary File Upload via main.php Upload Bypass 0.5%
  • CVE-2025-63018 Medium 4.3 WordPress Bard theme <= 2.229 - Broken Access Control vulnerability 0.3%
  • CVE-2025-5092 Medium 6.4 Multiple Plugins and Themes <= (Various Versions) - Authenticated (Contributor+) DOM-Based Stored Cross-Site Scripting via lightGallery JavaScript Library 0.3%
  • CVE-2025-6251 Medium 6.4 Royal Elementor Addons and Templates <= 1.7.1036 - Authenticated (Contributor+) Stored Cross-Site Scripting 0.2%
  • CVE-2025-24766 High 7.5 WordPress News Magazine X <= 1.2.35 - Local File Inclusion Vulnerability 0.6%
  • CVE-2025-5338 Medium 6.4 Royal Elementor Addons <= 1.7.1028 - Authenticated (Contributor+) Stored DOM-Based Cross-Site Scripting via Multiple Widgets 0.3%
  • CVE-2025-3813 Medium 6.4 Royal Elementor Addons and Templates <= 1.7.1020 - Authenticated (Contributor+) Stored Cross-Site Scripting 0.3%
  • CVE-2024-12120 Medium 5.4 Royal Elementor Addons and Templates <= 1.7.1017 - Authenticated (Contributor+) Stored Cross-Site Scripting 0.3%