Threat Entry Updated 2025-11-19

CVE-2025-6251 - Royal Elementor Addons And Templates Plugin

The Royal Elementor Addons and Templates plugin for WordPress is vulnerable to Stored Cross-Site Scripting via $item['field_id'] in all versions up to, and including, 1.7.1036 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

PLUGIN Royal Elementor Addons And Templates

CVE-2025-6251

MEDIUM CVSS 6.4 2025-11-19

Risk Score

Open Full Technical Breakdown

Threat Entry Updated 2025-07-11

CVE-2025-3813 - Royal Elementor Addons And Templates Plugin

The Royal Elementor Addons and Templates plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘_elementor_data’ parameter in all versions up to, and including, 1.7.1020 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

PLUGIN Royal Elementor Addons And Templates

CVE-2025-3813

MEDIUM CVSS 6.4 2025-05-31

Risk Score

Open Full Technical Breakdown

Threat Entry Updated 2025-07-11

CVE-2024-12120 - Royal Elementor Addons And Templates Plugin

The Royal Elementor Addons and Templates plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Countdown widget display_message_text parameter in all versions up to, and including, 1.7.1017 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

PLUGIN Royal Elementor Addons And Templates

CVE-2024-12120

MEDIUM CVSS 5.4 2025-05-07

Risk Score

Open Full Technical Breakdown

Threat Entry Updated 2025-07-08

CVE-2025-1456 - Royal Elementor Addons And Templates Plugin

The Royal Elementor Addons and Templates plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the `widgetGrid`, `widgetCountDown`, and `widgetInstagramFeed` methods in all versions up to, and including, 1.7.1012 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

PLUGIN Royal Elementor Addons And Templates

CVE-2025-1456

MEDIUM CVSS 6.4 2025-04-12

Risk Score

Open Full Technical Breakdown

Threat Entry Updated 2025-07-08

CVE-2025-1455 - Royal Elementor Addons And Templates Plugin

The Royal Elementor Addons and Templates plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Woo Grid widget in all versions up to, and including, 1.7.1012 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

PLUGIN Royal Elementor Addons And Templates

CVE-2025-1455

MEDIUM CVSS 6.4 2025-04-12

Risk Score

Open Full Technical Breakdown

Threat Entry Updated 2025-02-28

CVE-2025-1441 - Royal Elementor Addons And Templates Plugin

The Royal Elementor Addons and Templates plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.7.1007. This is due to missing or incorrect nonce validation on the 'wpr_filter_woo_products' function. This makes it possible for unauthenticated attackers to inject malicious web scripts via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.

PLUGIN Royal Elementor Addons And Templates

CVE-2025-1441

MEDIUM CVSS 6.1 2025-02-19

Risk Score

Open Full Technical Breakdown

Threat Entry Updated 2025-03-03

CVE-2025-0393 - Royal Elementor Addons And Templates Plugin

The Royal Elementor Addons and Templates plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.7.1006. This is due to missing or incorrect nonce validation on the wpr_filter_grid_posts() function. This makes it possible for unauthenticated attackers to inject malicious web scripts via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.

PLUGIN Royal Elementor Addons And Templates

CVE-2025-0393

MEDIUM CVSS 6.1 2025-01-14

Risk Score

Open Full Technical Breakdown

Threat Entry Updated 2025-03-04

CVE-2024-10798 - Royal Elementor Addons And Templates Plugin

The Royal Elementor Addons and Templates plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 1.7.1003 via the 'wpr-template' shortcode due to insufficient restrictions on which posts can be included. This makes it possible for authenticated attackers, with Contributor-level access and above, to extract data from private or draft posts created via Elementor that they should not have access to.

PLUGIN Royal Elementor Addons And Templates

CVE-2024-10798

MEDIUM CVSS 4.3 2024-11-28

Risk Score

Open Full Technical Breakdown

Threat Entry Updated 2024-11-19

CVE-2024-9682 - Royal Elementor Addons And Templates Plugin

The Royal Elementor Addons and Templates plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Form Builder widget in all versions up to, and including, 1.7.1001 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

PLUGIN Royal Elementor Addons And Templates

CVE-2024-9682

MEDIUM CVSS 6.4 2024-11-13

Risk Score

Open Full Technical Breakdown

Threat Entry Updated 2024-11-19

CVE-2024-9668 - Royal Elementor Addons And Templates Plugin

The Royal Elementor Addons and Templates plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Countdown widget in all versions up to, and including, 1.7.1001 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

PLUGIN Royal Elementor Addons And Templates

CVE-2024-9668

MEDIUM CVSS 6.4 2024-11-13

Risk Score

Open Full Technical Breakdown

Threat Entry Updated 2024-11-19

CVE-2024-9059 - Royal Elementor Addons And Templates Plugin

The Royal Elementor Addons and Templates plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Google Maps widget in all versions up to, and including, 1.7.1001 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

PLUGIN Royal Elementor Addons And Templates

CVE-2024-9059

MEDIUM CVSS 6.4 2024-11-13

Risk Score

Open Full Technical Breakdown

Threat Entry Updated 2025-01-10

CVE-2024-7417 - Royal Elementor Addons And Templates Plugin

The Royal Elementor Addons and Templates plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 1.3.986 via the data_fetch. This makes it possible for authenticated attackers, with subscriber-level access and above, to extract data from password protected posts.

PLUGIN Royal Elementor Addons And Templates

CVE-2024-7417

MEDIUM CVSS 4.3 2024-10-17

Risk Score

Open Full Technical Breakdown

Threat Entry Updated 2025-01-15

CVE-2024-8482 - Royal Elementor Addons And Templates Plugin

The Royal Elementor Addons and Templates plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘url’ parameter in all versions up to, and including, 1.3.982 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

PLUGIN Royal Elementor Addons And Templates

CVE-2024-8482

MEDIUM CVSS 6.4 2024-10-08

Risk Score

Open Full Technical Breakdown

Threat Entry Updated 2024-11-21

CVE-2024-5818 - Royal Elementor Addons And Templates Plugin

The Royal Elementor Addons and Templates plugin for WordPress is vulnerable to Stored DOM-based Cross-Site Scripting via the plugin's Magazine Grid/Slider widget in all versions up to, and including, 1.3.980 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

PLUGIN Royal Elementor Addons And Templates

CVE-2024-5818

MEDIUM CVSS 6.4 2024-07-24

Risk Score

Open Full Technical Breakdown

Threat Entry Updated 2024-11-21

CVE-2024-4489 - Royal Elementor Addons And Templates Plugin

The Royal Elementor Addons and Templates plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘custom_upload_mimes’ function in versions up to, and including, 1.3.976 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

PLUGIN Royal Elementor Addons And Templates

CVE-2024-4489

MEDIUM CVSS 6.4 2024-06-07

Risk Score

Open Full Technical Breakdown

Threat Entry Updated 2025-01-08

CVE-2024-4342 - Royal Elementor Addons And Templates Plugin

The Royal Elementor Addons and Templates plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's image hotspot, image accordion, off canvas, woogrid, and product mini cart widgets in all versions up to, and including, 1.3.975 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

PLUGIN Royal Elementor Addons And Templates

CVE-2024-4342

MEDIUM CVSS 6.4 2024-06-01

Risk Score

Open Full Technical Breakdown

Threat Entry Updated 2025-01-08

CVE-2024-4087 - Royal Elementor Addons And Templates Plugin

The Royal Elementor Addons and Templates plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Back to Top widget in all versions up to, and including, 1.3.975 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

PLUGIN Royal Elementor Addons And Templates

CVE-2024-4087

MEDIUM CVSS 6.4 2024-06-01

Risk Score

Open Full Technical Breakdown

Threat Entry Updated 2025-01-15

CVE-2024-3887 - Royal Elementor Addons And Templates Plugin

The Royal Elementor Addons and Templates plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Form Builder widget in all versions up to, and including, 1.3.974 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

PLUGIN Royal Elementor Addons And Templates

CVE-2024-3887

MEDIUM CVSS 5.4 2024-05-16

Risk Score

Open Full Technical Breakdown

Threat Entry Updated 2025-01-08

CVE-2024-3675 - Royal Elementor Addons And Templates Plugin

The Royal Elementor Addons and Templates plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Flip Carousel, Flip Box, Post Grid, and Taxonomy List widgets in all versions up to, and including, 1.3.971 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

PLUGIN Royal Elementor Addons And Templates

CVE-2024-3675

MEDIUM CVSS 6.4 2024-05-02

Risk Score

Open Full Technical Breakdown

Threat Entry Updated 2025-01-08

CVE-2024-1567 - Royal Elementor Addons And Templates Plugin

The Royal Elementor Addons and Templates plugin for WordPress is vulnerable to limited file uploads due to missing file type validation in the 'file_validity' function in all versions up to, and including, 1.3.94. This makes it possible for unauthenticated attackers to upload dangerous file types such as .svgz on the affected site's server which may make cross-site scripting or remote code execution possible.

PLUGIN Royal Elementor Addons And Templates

CVE-2024-1567

HIGH CVSS 8.2 2024-05-02

Risk Score

Open Full Technical Breakdown