Live Vulnerability Intelligence
Threat Database
Search CVEs, inspect descriptions, and open detail pages with AI-assisted technical context.
Threat Entry
Updated 2026-11-07
Royal Elementor Addons - Security Vulnerability (CVE-2026-119519)
Missing Authorization vulnerability in WProyal Royal Elementor Addons royal-elementor-addons allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Royal Elementor Addons: from n/a through 1.7.1068.
PLUGIN
Royal Elementor Addons
CVE-2026-119519
Risk Score
Threat Entry
Updated 2026-10-26
Royal Elementor Addons - Security Vulnerability (CVE-2026-97254)
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WProyal Royal Elementor Addons royal-elementor-addons allows Stored XSS.This issue affects Royal Elementor Addons: from n/a through 1.7.1069.
PLUGIN
Royal Elementor Addons
CVE-2026-97254
Risk Score
Threat Entry
Updated 2026-10-26
Royal Elementor Addons - Security Vulnerability (CVE-2026-97255)
Authorization Bypass Through User-Controlled Key vulnerability in WProyal Royal Elementor Addons royal-elementor-addons allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Royal Elementor Addons: from n/a through 1.7.1069.
PLUGIN
Royal Elementor Addons
CVE-2026-97255
Risk Score
Threat Entry
Updated 2026-10-26
Royal Elementor Addons - Security Vulnerability (CVE-2026-112865)
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WProyal Royal Elementor Addons royal-elementor-addons allows DOM-Based XSS.This issue affects Royal Elementor Addons: from n/a through 1.7.1069.
PLUGIN
Royal Elementor Addons
CVE-2026-112865
Risk Score
Threat Entry
Updated 2026-09-16
Royal Elementor Addons - Security Vulnerability (CVE-2026-13407)
The Royal Elementor Addons WordPress plugin before 1.7.1067 does not properly sanitize and escape values submitted through its form widget before including them in the body of administrator notification emails, allowing unauthenticated attackers to inject arbitrary HTML into emails sent to the site administrator on form submission.
PLUGIN
Royal Elementor Addons
CVE-2026-13407
Risk Score
Threat Entry
Updated 2026-09-14
Royal Elementor Addons - Security Vulnerability (CVE-2026-17585)
The Royal Addons for Elementor – Addons and Templates Kit for Elementor plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.7.1066 via the 'wpr_keyword' parameter. This makes it possible for unauthenticated attackers to extract arbitrary postmeta values from all published posts via character-by-character substring matching across the entire wp_postmeta table. The required nonce is emitted publicly via wp_localize_script on any frontend page that loads a Royal Elementor widget, meaning no authenticated session or prior action is needed to obtain it.
PLUGIN
Royal Elementor Addons
CVE-2026-17585
Risk Score
Threat Entry
Updated 2026-08-20
Royal Elementor Addons - Server-Side Request Forgery (SSRF) (CVE-2026-17123)
The Royal Elementor Addons plugin for WordPress is vulnerable to Server-Side Request Forgery in versions up to, and including, 1.7.1064 via the Form Builder widget's 'webhook_url' setting. The widget's render() method persists the attacker-controlled URL into the wpr_webhook_url_{widget_id} option on every render (including a Contributor previewing their own draft), and the wpr_form_builder_webhook AJAX handler — registered for both authenticated and unauthenticated callers — reads that option and dispatches the outbound request via the non-safe wp_remote_post(), with no host allowlist, no scheme restriction, and no private/loopback IP filter (the plugin's existing…
PLUGIN
Royal Elementor Addons
CVE-2026-17123
Risk Score
Threat Entry
Updated 2026-06-22
Royal Elementor Addons - Security Vulnerability (CVE-2026-8118)
The Royal Addons for Elementor – Addons and Templates Kit for Elementor plugin for WordPress is vulnerable to Arbitrary File Read in versions 1.7.1058 through 1.7.1059. This is due to the wpr_get_csv_handle() helper (introduced in version 1.7.1058 as part of the patch for CVE-2026-6229) falling back to is_readable() and fopen($source, 'r') on the attacker-controlled settings.table_upload_csv.url value when it does not parse as an HTTP URL, with no allow-list, traversal block, or extension check. This makes it possible for authenticated attackers, with Contributor-level access and above, to save a crafted wpr-data-table…
PLUGIN
Royal Elementor Addons
CVE-2026-8118
Risk Score
Threat Entry
Updated 2026-06-17
Royal Elementor Addons - Cross-Site Scripting (XSS) (CVE-2026-6504)
The Royal Elementor Addons and Templates plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'title_tag' parameter in all versions up to, and including, 1.7.1058 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
PLUGIN
Royal Elementor Addons
CVE-2026-6504
Risk Score
Threat Entry
Updated 2026-06-17
Royal Elementor Addons - Cross-Site Scripting (XSS) (CVE-2026-4803)
The Royal Elementor Addons plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'status' parameter in the wpr_update_form_action_meta AJAX action in all versions up to, and including, 1.7.1056. This is due to insufficient input sanitization and output escaping, combined with a publicly leaked nonce that allows unauthenticated access to the AJAX handler. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
PLUGIN
Royal Elementor Addons
CVE-2026-4803
Risk Score
Threat Entry
Updated 2026-06-17
Royal Elementor Addons - Cross-Site Scripting (XSS) (CVE-2026-5159)
The Royal Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Instagram Feed widget's 'instagram_follow_text' setting in all versions up to, and including, 1.7.1056 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Note that exploitation requires that an administrator has previously configured the Instagram Feed widget with a valid Instagram access token on the site.
PLUGIN
Royal Elementor Addons
CVE-2026-5159
Risk Score
Threat Entry
Updated 2026-06-17
Royal Elementor Addons - Broken Access Control (CVE-2026-4024)
The Royal Addons for Elementor plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the `wpr_update_form_action_meta` AJAX action in all versions up to, and including, 1.7.1056. The handler is registered on both `wp_ajax` and `wp_ajax_nopriv` hooks, making it accessible to unauthenticated users. Although a nonce is verified, the nonce (`wpr-addons-js`) is publicly exposed in frontend JavaScript via `WprConfig.nonce` on any page that loads Royal Addons widgets, rendering the protection ineffective. The endpoint also lacks any capability or ownership checks and directly calls…
PLUGIN
Royal Elementor Addons
CVE-2026-4024
Risk Score
Threat Entry
Updated 2026-08-18
Royal Elementor Addons - Server-Side Request Forgery (SSRF) (CVE-2026-6229)
The Royal Elementor Addons plugin for WordPress is vulnerable to Server-Side Request Forgery in versions up to, and including, 1.7.1057. This is due to insufficient validation of user-supplied URLs in the render_csv_data() function, which can be bypassed by including 'docs.google.com/spreadsheets' in a query parameter, and the subsequent use of these URLs in fopen() calls without blocking internal or private network addresses. This makes it possible for authenticated attackers, with Contributor-level access and above, to make requests to arbitrary URLs and retrieve sensitive information from internal services.
PLUGIN
Royal Elementor Addons
CVE-2026-6229
Risk Score
Threat Entry
Updated 2026-08-14
Royal Elementor Addons - Cross-Site Scripting (XSS) (CVE-2026-5428)
The Royal Elementor Addons plugin for WordPress is vulnerable to Stored Cross-Site Scripting via image captions in the Image Grid/Slider/Carousel widget in versions up to and including 1.7.1056. This is due to insufficient output escaping in the render_post_thumbnail() function, where wp_kses_post() is used instead of esc_attr() for the alt attribute context. This makes it possible for authenticated attackers, with Author-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses a page with the malicious image displayed in the media grid widget.
PLUGIN
Royal Elementor Addons
CVE-2026-5428
Risk Score
Threat Entry
Updated 2026-06-17
Royal Elementor Addons - Cross-Site Scripting (XSS) (CVE-2026-5162)
The Royal Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Instagram Feed widget's 'instagram_follow_text' setting in all versions up to, and including, 1.7.1056 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
PLUGIN
Royal Elementor Addons
CVE-2026-5162
Risk Score
Threat Entry
Updated 2026-10-26
Royal Elementor Addons - Broken Access Control (CVE-2026-40763)
Missing Authorization vulnerability in WP Royal Royal Elementor Addons royal-elementor-addons allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Royal Elementor Addons: from n/a through
PLUGIN
Royal Elementor Addons
CVE-2026-40763
Risk Score
Threat Entry
Updated 2026-07-24
Royal Elementor Addons - Cross-Site Scripting (XSS) (CVE-2026-0664)
The Royal Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'button_text' parameter in all versions up to, and including, 1.7.1049 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
PLUGIN
Royal Elementor Addons
CVE-2026-0664
Risk Score
Threat Entry
Updated 2026-06-17
Royal Elementor Addons - Remote Code Execution (CVE-2025-13067)
The Royal Addons for Elementor plugin for WordPress is vulnerable to arbitrary file upload in all versions up to, and including, 1.7.1049. This is due to insufficient file type validation detecting files named main.php, allowing a file with such a name to bypass sanitization. This makes it possible for authenticated attackers, with author-level access and above, to upload arbitrary files on the affected site's server which may make remote code execution possible.
PLUGIN
Royal Elementor Addons
CVE-2025-13067
Risk Score
Threat Entry
Updated 2026-06-17
Royal Elementor Addons - Security Vulnerability (CVE-2026-28135)
Inclusion of Functionality from Untrusted Control Sphere vulnerability in WP Royal Royal Elementor Addons royal-elementor-addons allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Royal Elementor Addons: from n/a through
PLUGIN
Royal Elementor Addons
CVE-2026-28135
Risk Score
Threat Entry
Updated 2026-06-17
Royal Elementor Addons - Cross-Site Scripting (XSS) (CVE-2025-6251)
The Royal Elementor Addons and Templates plugin for WordPress is vulnerable to Stored Cross-Site Scripting via $item['field_id'] in all versions up to, and including, 1.7.1036 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
PLUGIN
Royal Elementor Addons
CVE-2025-6251
Risk Score