RE
Product
Royal Elementor Addons
58
CVEs
0
On KEV
9.8
Max CVSS
0
New 30D
Severity mix
Critical 3High 8Medium 46Low 1
Watch
Add Royal Elementor Addons to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2024-32786 | 9.8 | May 17 | Authentication Bypass by Spoofing vulnerability in WP Royal Royal Elementor Addons allows Functionality Bypass.This issue affects Royal Elementor Addons: from n/a through 1.3.93 Affected: before 1.3.95 |
| CVE-2024-1567 | 9.8 | May 2 | The Royal Elementor Addons and Templates plugin for WordPress is vulnerable to limited file uploads due to missing file type validation in the 'file_validity' function in all… Affected: before 1.3.95 |
| CVE-2023-5360 | 9.8 | Oct 31 | The Royal Elementor Addons and Templates WordPress plugin before 1.3.79 does not properly validate uploaded files, which could allow unauthenticated users to upload arbitrary… Affected: before 1.3.79 |
| CVE-2025-1441 | 8.8 | Feb 19 | Royal Elementor Addons and Templates <= 1.7.1007 - Cross-Site Request Forgery to Reflected Cross-Site Scripting Affected: through 1.7.1007 |
| CVE-2022-47175 | 8.8 | Oct 6 | Cross-Site Request Forgery (CSRF) vulnerability in P Royal Royal Elementor Addons and Templates plugin <= 1.3.75 versions Affected: through 1.3.75 |
| CVE-2022-4701 | 8.8 | Jan 10 | The Royal Elementor Addons plugin for WordPress is vulnerable to insufficient access control in the 'wpr_activate_required_plugins' AJAX action in versions up to, and including,… Affected: through 1.3.59 |
| CVE-2022-4700 | 8.8 | Jan 10 | The Royal Elementor Addons plugin for WordPress is vulnerable to insufficient access control in the 'wpr_activate_required_theme' AJAX action in versions up to, and including,… Affected: through 1.3.59 |
| CVE-2022-4704 | 8.1 | Jan 10 | The Royal Elementor Addons plugin for WordPress is vulnerable to insufficient access control in the 'wpr_import_templates_kit' AJAX action in versions up to, and including, 1.3.59 Affected: through 1.3.59 |
| CVE-2022-4703 | 8.1 | Jan 10 | The Royal Elementor Addons plugin for WordPress is vulnerable to insufficient access control in the 'wpr_reset_previous_import' AJAX action in versions up to, and including,… Affected: through 1.3.59 |
| CVE-2023-5922 | 7.5 | Jan 16 | The Royal Elementor Addons and Templates WordPress plugin before 1.3.81 does not ensure that users accessing posts via an AJAX action (and REST endpoint, currently disabled in the… Affected: before 1.3.81 |
| CVE-2024-50442 | 7.2 | Oct 28 | Improper Restriction of XML External Entity Reference vulnerability in WP Royal Royal Elementor Addons royal-elementor-addons allows XML Injection.This issue affects Royal… Affected: before 1.3.981 |
| CVE-2022-4709 | 6.5 | Jan 10 | The Royal Elementor Addons plugin for WordPress is vulnerable to insufficient access control in the 'wpr_import_library_template' AJAX action in versions up to, and including,… Affected: through 1.3.59 |
| CVE-2022-4708 | 6.5 | Jan 10 | The Royal Elementor Addons plugin for WordPress is vulnerable to insufficient access control in the 'wpr_save_template_conditions' AJAX action in versions up to, and including,… Affected: through 1.3.59 |
| CVE-2022-4707 | 6.5 | Jan 10 | The Royal Elementor Addons plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.3.59 Affected: through 1.3.59 |
| CVE-2022-4702 | 6.5 | Jan 10 | The Royal Elementor Addons plugin for WordPress is vulnerable to insufficient access control in the 'wpr_fix_royal_compatibility' AJAX action in versions up to, and including,… Affected: through 1.3.59 |
| CVE-2024-8482 | 6.4 | Oct 8 | The Royal Elementor Addons and Templates plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘url’ parameter in all versions up to, and including, 1.3.982… Affected: before 1.3.987 |
| CVE-2024-3675 | 6.4 | May 2 | The Royal Elementor Addons and Templates plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Flip Carousel, Flip Box, Post Grid, and Taxonomy List… Affected: before 1.3.972 |
| CVE-2024-3889 | 6.4 | Apr 23 | The Royal Elementor Addons and Templates plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Advanced Accordion widget in all versions up to, and… Affected: before 1.3.972 |
| CVE-2024-2799 | 6.4 | Apr 23 | The Royal Elementor Addons and Templates plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Image Grid & Advanced Text widget HTML tags in all versions up… Affected: before 1.3.97 |
| CVE-2024-2798 | 6.4 | Apr 23 | The Royal Elementor Addons and Templates plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's widget containers in all versions up to, and including,… Affected: before 1.3.972 |
| CVE-2024-0442 | 6.4 | Feb 29 | The Royal Elementor Addons and Templates plugin for WordPress is vulnerable to Stored Cross-Site Scripting via element URL parameters in all versions up to, and including, 1.3.87… Affected: before 1.3.88 |
| CVE-2025-0393 | 6.1 | Jan 14 | Royal Elementor Addons and Templates <= 1.7.1006 - Cross-Site Request Forgery to Reflected Cross-Site Scripting Affected: through 1.7.1006 |
| CVE-2024-56226 | 6.1 | Dec 31 | WordPress Royal Elementor Addons plugin <= 1.7.1001 - Reflected Cross Site Scripting (XSS) vulnerability Affected: before 1.7.1002 |
| CVE-2022-4710 | 6.1 | Jan 10 | The Royal Elementor Addons plugin for WordPress is vulnerable to Reflected Cross-Site Scripting in versions up to, and including, 1.3.59, due to due to insufficient input… Affected: through 1.3.59 |
| CVE-2025-5338 | 5.4 | Jun 26 | Royal Elementor Addons <= 1.7.1028 - Authenticated (Contributor+) Stored DOM-Based Cross-Site Scripting via Multiple Widgets Affected: before 1.7.1025 |
| CVE-2025-3813 | 5.4 | May 31 | Royal Elementor Addons and Templates <= 1.7.1020 - Authenticated (Contributor+) Stored Cross-Site Scripting Affected: before 1.7.1021 |
| CVE-2025-39361 | 5.4 | May 7 | WordPress Royal Elementor Addons plugin <= 1.7.1017 - Cross Site Scripting (XSS) vulnerability Affected: before 1.7.1018 |
| CVE-2024-12120 | 5.4 | May 7 | Royal Elementor Addons and Templates <= 1.7.1017 - Authenticated (Contributor+) Stored Cross-Site Scripting Affected: before 1.7.1018 |
| CVE-2025-1456 | 5.4 | Apr 12 | Royal Elementor Addons and Templates <= 1.7.1012 - Authenticated DOM-Based (Contributor+) Stored Cross-Site Scripting Affected: before 1.7.1013 |
| CVE-2025-1455 | 5.4 | Apr 12 | Royal Elementor Addons and Templates <= 1.7.1012 - Authenticated (Contributor+) Stored Cross-Site Scripting Affected: before 1.7.1013 |
| CVE-2024-56062 | 5.4 | Dec 31 | WordPress Royal Elementor Addons and Templates plugin <= 1.3.987 - Cross Site Scripting (XSS) vulnerability Affected: through 1.3.987 |
| CVE-2024-9682 | 5.4 | Nov 13 | Royal Elementor Addons and Templates <= 1.7.1001 - Authenticated (Contributor+) DOM-Based Stored Cross-Site Scripting via Form Builder Widget Affected: before 1.7.1002 |
| CVE-2024-9668 | 5.4 | Nov 13 | Royal Elementor Addons and Templates <= 1.7.1001 - Authenticated (Contributor+) Stored Cross-Site Scripting via Countdown Widget Affected: before 1.7.1002 |
| CVE-2024-9059 | 5.4 | Nov 13 | Royal Elementor Addons and Template <= 1.7.1001 - Authenticated (Contributor+) DOM-Based Stored Cross-Site Scripting via Google Maps Widget Affected: before 1.7.1002 |
| CVE-2024-44001 | 5.4 | Sep 18 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WP Royal Royal Elementor Addons royal-elementor-addons.This issue affects… Affected: through 1.3.982 |
| CVE-2024-5818 | 5.4 | Jul 24 | The Royal Elementor Addons and Templates plugin for WordPress is vulnerable to Stored DOM-based Cross-Site Scripting via the plugin's Magazine Grid/Slider widget in all versions… Affected: before 1.3.981 |
| CVE-2024-4489 | 5.4 | Jun 7 | The Royal Elementor Addons and Templates plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘custom_upload_mimes’ function in versions up to, and including,… Affected: before 1.3.977 |
| CVE-2024-4488 | 5.4 | Jun 7 | The Royal Elementor Addons and Templates for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘inline_list’ parameter in versions up to, and including, 1.3.976 due… Affected: before 1.3.977 |
| CVE-2024-4342 | 5.4 | Jun 1 | The Royal Elementor Addons and Templates plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's image hotspot, image accordion, off canvas, woogrid,… Affected: before 1.3.976 |
| CVE-2024-4087 | 5.4 | Jun 1 | The Royal Elementor Addons and Templates plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Back to Top widget in all versions up to, and… Affected: before 1.3.976 |
| CVE-2024-3887 | 5.4 | May 16 | The Royal Elementor Addons and Templates plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Form Builder widget in all versions up to, and including,… Affected: before 1.3.975 |
| CVE-2024-31236 | 5.4 | Apr 7 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WP Royal Royal Elementor Addons allows Stored XSS.This issue affects Royal… Affected: before 1.3.94 |
| CVE-2024-1500 | 5.4 | Mar 7 | The Royal Elementor Addons and Templates plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Logo Widget in all versions up to, and including, 1.3.91 due to… Affected: before 1.3.92 |
| CVE-2024-0516 | 5.3 | Feb 29 | The Royal Elementor Addons and Templates plugin for WordPress is vulnerable to unauthorized post metadata update due to a missing capability check on the… Affected: before 1.3.88 |
| CVE-2023-3709 | 5.3 | Jul 18 | The Royal Elementor Addons plugin for WordPress is vulnerable to unauthenticated API key disclosure in versions up to, and including, 1.3.70 due to the plugin adding the API key… Affected: through 1.3.70 |
| CVE-2025-26990 | 4.9 | Apr 15 | WordPress Royal Elementor Addons plugin <= 1.7.1006 - Server Side Request Forgery (SSRF) vulnerability Affected: before 1.7.1007 |
| CVE-2024-56227 | 4.3 | Dec 31 | WordPress Royal Elementor Addons plugin <= 1.7.1001 - Broken Access Control vulnerability Affected: before 1.7.1002 |
| CVE-2024-10798 | 4.3 | Nov 28 | Royal Elementor Addons and Templates <= 1.7.1003 - Authenticated (Contributor+) Post Disclosure Affected: through 1.7.1003 |
| CVE-2024-7417 | 4.3 | Oct 17 | The Royal Elementor Addons and Templates plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 1.3.986 via the data_fetch Affected: through 1.3.986 |
| CVE-2024-0515 | 4.3 | Feb 29 | The Royal Elementor Addons and Templates plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.3.87 Affected: before 1.3.88 |