EN ES
Start free
Menu

Royal Addons for Elementor: known security problems

100 known security problems reported for this WordPress plugin, with the affected versions, the fix and what to do.

Updated

In short

There are 100 known security problems on this page. Each one has a fixed version. Updating to version 1.7.1070 or newer covers every fixed problem listed here.

Based on public reports. Check the plugin’s changelog. Watchfox AI may be wrong.

Get an email when your site is affected: install Watchfox AI (free)

This week

Someone with a contributor account on your site could plant harmful code that runs for your visitors or admins (from 1.7.1037 up to and including 1.7.1069)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • From 1.7.1037 up to and including 1.7.1069
Fixed in
1.7.1070
What to do
If your site has an affected version, update Royal Addons for Elementor to version 1.7.1070 or newer.
Official ID
CVE-2026-107098
Report title
Royal Addons for Elementor – Addons and Templates Kit for Elementor 1.7.1037 - 1.7.1069 - Authenticated (Contributor+) Stored Cross-Site Scripting
First reported
Sources
This week

Someone could do things on your site they should not be allowed to (from 1.3.71 up to and including 1.7.1069)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • From 1.3.71 up to and including 1.7.1069
Fixed in
1.7.1070
What to do
If your site has an affected version, update Royal Addons for Elementor to version 1.7.1070 or newer.
Official ID
CVE-2026-107097
Report title
Royal Addons for Elementor – Addons and Templates Kit for Elementor 1.3.71 - 1.7.1069 - Missing Authorization
First reported
Sources
This week

A stranger could use it to harm your site (from 1.3.81 up to and including 1.7.1069)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • From 1.3.81 up to and including 1.7.1069
Fixed in
1.7.1070
What to do
If your site has an affected version, update Royal Addons for Elementor to version 1.7.1070 or newer.
Official ID
CVE-2026-107100
Report title
Royal Addons for Elementor – Addons and Templates Kit for Elementor 1.3.81 - 1.7.1069 - Unauthenticated Information Exposure
First reported
Sources
This week

Someone could do things on your site they should not be allowed to (from 1.3.68 up to and including 1.7.1069)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • From 1.3.68 up to and including 1.7.1069
Fixed in
1.7.1070
What to do
If your site has an affected version, update Royal Addons for Elementor to version 1.7.1070 or newer.
Official ID
CVE-2026-106647
Report title
Royal Addons for Elementor – Addons and Templates Kit for Elementor 1.3.68 - 1.7.1069 - Missing Authorization
First reported
Sources
This week

A stranger could use it to harm your site (up to and including 1.7.1069)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 1.7.1069
Fixed in
1.7.1070
What to do
If your site has an affected version, update Royal Addons for Elementor to version 1.7.1070 or newer.
Official ID
CVE-2026-97255
Report title
Royal Addons for Elementor – Addons and Templates Kit for Elementor <= 1.7.1069 - Unauthenticated Insecure Direct Object Reference
First reported
Sources
This week

Someone with a contributor account on your site could plant harmful code that runs for your visitors or admins (up to and including 1.7.1069)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 1.7.1069
Fixed in
1.7.1070
What to do
If your site has an affected version, update Royal Addons for Elementor to version 1.7.1070 or newer.
Official ID
CVE-2026-97254
Report title
Royal Addons for Elementor – Addons and Templates Kit for Elementor <= 1.7.1069 - Authenticated (Contributor+) Stored Cross-Site Scripting
First reported
Sources
This week

Someone with a contributor account on your site could plant harmful code that runs for your visitors or admins (up to and including 1.7.1069) (2)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 1.7.1069
Fixed in
1.7.1070
What to do
If your site has an affected version, update Royal Addons for Elementor to version 1.7.1070 or newer.
Official ID
CVE-2026-112865
Report title
Royal Addons for Elementor – Addons and Templates Kit for Elementor <= 1.7.1069 - Authenticated (Contributor+) Stored Cross-Site Scripting
First reported
Sources
This week

A stranger could use it to harm your site (before 1.7.1070)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Before 1.7.1070
Fixed in
1.7.1070
What to do
If your site has an affected version, update Royal Addons for Elementor to version 1.7.1070 or newer.
Official ID
CVE-2026-106648
Report title
Royal Addons for Elementor – Addons and Templates Kit for Elementor < 1.7.1070 - Unauthenticated Unauthorized Email Relay
First reported
Sources
This week

Someone with a contributor account on your site could run their own code on your site and take it over

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 1.7.1068
Fixed in
1.7.1069
What to do
If your site has an affected version, update Royal Addons for Elementor to version 1.7.1069 or newer.
Official ID
CVE-2026-111851
Report title
Royal Addons for Elementor – Addons and Templates Kit for Elementor <= 1.7.1068 - Authenticated (Contributor+) Remote Code Execution
First reported
Sources
This week

A stranger could use it to harm your site (up to and including 1.7.1066)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 1.7.1066
Fixed in
1.7.1067
What to do
If your site has an affected version, update Royal Addons for Elementor to version 1.7.1067 or newer.
Official ID
CVE-2026-13407
Report title
Royal Elementor Addons <= 1.7.1066 - Unauthenticated Arbitrary HTML Injection in Notification Emails
First reported
Sources
This week

A stranger could see private information they should not see

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 1.7.1066
Fixed in
1.7.1067
What to do
If your site has an affected version, update Royal Addons for Elementor to version 1.7.1067 or newer.
Official ID
CVE-2026-17585
Report title
Royal Addons for Elementor <= 1.7.1066 - Unauthenticated Sensitive Information Exposure via Unfiltered meta_query LIKE Oracle in 'wpr_keyword' Parameter
First reported
Sources
This week

Someone could do things on your site they should not be allowed to (before 1.7.1066)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Before 1.7.1066
Fixed in
1.7.1066
What to do
If your site has an affected version, update Royal Addons for Elementor to version 1.7.1066 or newer.
Official ID
CVE-2026-13406
Report title
Royal Addons for Elementor – Addons and Templates Kit for Elementor < 1.7.1066 - Missing Authorization
First reported
Sources
This week

Someone with a contributor account on your site could plant harmful code that runs for your visitors or admins (before 1.7.1066)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Before 1.7.1066
Fixed in
1.7.1066
What to do
If your site has an affected version, update Royal Addons for Elementor to version 1.7.1066 or newer.
Official ID
CVE-2026-19226
Report title
Royal Addons for Elementor – Addons and Templates Kit for Elementor < 1.7.1066 - Authenticated (Contributor+) Stored Cross-Site Scripting
First reported
Sources
This week

A stranger could use it to harm your site (before 1.7.1066)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Before 1.7.1066
Fixed in
1.7.1066
What to do
If your site has an affected version, update Royal Addons for Elementor to version 1.7.1066 or newer.
Official ID
CVE-2026-13404
Report title
Royal Addons for Elementor – Addons and Templates Kit for Elementor < 1.7.1066 - Unauthenticated Like Count Manipulation
First reported
Sources
This week

Someone who already has an admin account could run their own code on your site and take it over

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Before 1.7.1066
Fixed in
1.7.1066
What to do
If your site has an affected version, update Royal Addons for Elementor to version 1.7.1066 or newer.
Official ID
CVE-2026-13405
Report title
Royal Addons for Elementor – Addons and Templates Kit for Elementor < 1.7.1066 - Authenticated (Administrator+) Remote Code Execution
First reported
Sources
This week

Someone with a contributor account on your site could make your server visit other addresses on their behalf (up to and including 1.7.1064)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 1.7.1064
Fixed in
1.7.1065
What to do
If your site has an affected version, update Royal Addons for Elementor to version 1.7.1065 or newer.
Official ID
CVE-2026-17123
Report title
Royal Addons for Elementor <= 1.7.1064 - Authenticated (Contributor+) Server-Side Request Forgery via Form Builder Widget 'webhook_url' Setting
First reported
Sources
This week

Someone with a contributor account on your site could plant harmful code that runs for your visitors or admins (up to and including 1.7.1064)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 1.7.1064
Fixed in
1.7.1065
What to do
If your site has an affected version, update Royal Addons for Elementor to version 1.7.1065 or newer.
Official ID
CVE-2026-19217
Report title
Royal Elementor Addons <= 1.7.1064 - Authenticated (Contributor+) Stored Cross-Site Scripting
First reported
Sources
This week

A stranger could use it to harm your site (up to and including 1.7.1062)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 1.7.1062
Fixed in
1.7.1063
What to do
If your site has an affected version, update Royal Addons for Elementor to version 1.7.1063 or newer.
Official ID
CVE-2026-13402
Report title
Royal Elementor Addons <= 1.7.1062 - Unauthenticated Information Exposure
First reported
Sources
This week

Someone with a contributor account on your site could read or delete private files on your server

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • From 1.7.1058 up to and including 1.7.1059
Fixed in
1.7.1060
What to do
If your site has an affected version, update Royal Addons for Elementor to version 1.7.1060 or newer.
Official ID
CVE-2026-8118
Report title
Royal Addons for Elementor – Addons and Templates Kit for Elementor 1.7.1058 - 1.7.1059 - Authenticated (Contributor+) Arbitrary File Read via Data Table Widget CSV File Source
First reported
Sources
This week

Someone with a contributor account on your site could plant harmful code that runs for your visitors or admins (up to and including 1.7.1058)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 1.7.1058
Fixed in
1.7.1059
What to do
If your site has an affected version, update Royal Addons for Elementor to version 1.7.1059 or newer.
Official ID
CVE-2026-6504
Report title
Royal Addons for Elementor <= 1.7.1058 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'title_tag' Parameter
First reported
Sources
This week

Someone could do things on your site they should not be allowed to (before 1.7.1053)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Before 1.7.1053
Fixed in
1.7.1053
What to do
If your site has an affected version, update Royal Addons for Elementor to version 1.7.1053 or newer.
Official ID
CVE-2026-25436
Report title
Royal Addons for Elementor – Addons and Templates Kit for Elementor < 1.7.1053 - Missing Authorization
First reported
Sources
This week

Someone with a contributor account on your site could plant harmful code that runs for your visitors or admins (before 1.7.1053)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Before 1.7.1053
Fixed in
1.7.1053
What to do
If your site has an affected version, update Royal Addons for Elementor to version 1.7.1053 or newer.
Official ID
CVE-2026-27421
Report title
Royal Addons for Elementor – Addons and Templates Kit for Elementor < 1.7.1053 - Authenticated (Contributor+) Stored Cross-Site Scripting
First reported
Sources
This week

Someone with a contributor account on your site could plant harmful code that runs for your visitors or admins (up to and including 1.7.1056)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 1.7.1056
Fixed in
1.7.1057
What to do
If your site has an affected version, update Royal Addons for Elementor to version 1.7.1057 or newer.
Official ID
CVE-2026-5159
Report title
Royal Addons for Elementor <= 1.7.1056 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'Follow Button Text' Parameter
First reported
Sources
This week

A stranger could plant harmful code that runs for your visitors or admins (up to and including 1.7.1056)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 1.7.1056
Fixed in
1.7.1057
What to do
If your site has an affected version, update Royal Addons for Elementor to version 1.7.1057 or newer.
Official ID
CVE-2026-4803
Report title
Royal Addons for Elementor <= 1.7.1056 - Unauthenticated Stored Cross-Site Scripting via 'status' Parameter in wpr_update_form_action_meta
First reported
Sources
This week

A stranger could do things on your site they should not be allowed to (up to and including 1.7.1056)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 1.7.1056
Fixed in
1.7.1057
What to do
If your site has an affected version, update Royal Addons for Elementor to version 1.7.1057 or newer.
Official ID
CVE-2026-4024
Report title
Royal Addons for Elementor <= 1.7.1056 - Missing Authorization to Unauthenticated Form Action Meta Modification
First reported
Sources
This week

Someone with a contributor account on your site could make your server visit other addresses on their behalf (up to and including 1.7.1057)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 1.7.1057
Fixed in
1.7.1058
What to do
If your site has an affected version, update Royal Addons for Elementor to version 1.7.1058 or newer.
Official ID
CVE-2026-6229
Report title
Royal Addons for Elementor <= 1.7.1057 - Authenticated (Contributor+) Server-Side Request Forgery via CSV URL Parameter
First reported
Sources
This week

Someone with an author account on your site could plant harmful code that runs for your visitors or admins (up to and including 1.7.1056)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 1.7.1056
Fixed in
1.7.1057
What to do
If your site has an affected version, update Royal Addons for Elementor to version 1.7.1057 or newer.
Official ID
CVE-2026-5428
Report title
Royal Addons for Elementor <= 1.7.1056 - Authenticated (Author+) Stored Cross-Site Scripting via Image Caption Field
First reported
Sources
This week

Someone with a contributor account on your site could plant harmful code that runs for your visitors or admins (up to and including 1.7.1056) (2)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 1.7.1056
Fixed in
1.7.1057
What to do
If your site has an affected version, update Royal Addons for Elementor to version 1.7.1057 or newer.
Official ID
CVE-2026-5162
Report title
Royal Addons for Elementor <= 1.7.1056 - Authenticated (Contributor+) Stored Cross-Site Scripting via Instagram Feed Widget
First reported
Sources
This week

A stranger could plant harmful code that runs for your visitors or admins (before 1.7.1041)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Before 1.7.1041
Fixed in
1.7.1041
What to do
If your site has an affected version, update Royal Addons for Elementor to version 1.7.1041 or newer.
Official ID
CVE-2026-40720
Report title
Royal Elementor Addons < 1.7.1041 - Unauthenticated Stored Cross-Site Scripting
First reported
Sources
This week

Someone with a contributor account on your site could plant harmful code that runs for your visitors or admins (up to and including 1.7.1049)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 1.7.1049
Fixed in
1.7.1050
What to do
If your site has an affected version, update Royal Addons for Elementor to version 1.7.1050 or newer.
Official ID
CVE-2026-0664
Report title
Royal Elementor Addons <= 1.7.1049 - Authenticated (Contributor+) Stored Cross-Site Scripting via REST API Meta Bypass
First reported
Sources
This week

Someone could do things on your site they should not be allowed to (up to and including 1.7.1056)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 1.7.1056
Fixed in
1.7.1057
What to do
If your site has an affected version, update Royal Addons for Elementor to version 1.7.1057 or newer.
Official ID
CVE-2026-40763
Report title
Royal Elementor Addons <= 1.7.1056 - Missing Authorization
First reported
Sources
This week

A stranger could do things on your site they should not be allowed to (up to and including 1.7.1049)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 1.7.1049
Fixed in
1.7.1050
What to do
If your site has an affected version, update Royal Addons for Elementor to version 1.7.1050 or newer.
Official ID
CVE-2026-2373
Report title
Royal Addons for Elementor – Addons and Templates Kit for Elementor <= 1.7.1049 - Missing Authorization to Unauthenticated Custom Post Type Contents Exposure
First reported
Sources
This week

Someone with an author account on your site could run their own code on your site and take it over

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 1.7.1049
Fixed in
1.7.1050
What to do
If your site has an affected version, update Royal Addons for Elementor to version 1.7.1050 or newer.
Official ID
CVE-2025-13067
Report title
Royal Addons for Elementor <= 1.7.1049 - Authenticated (Author+) Arbitrary File Upload via main.php Upload Bypass
First reported
Sources
This week

Someone could do things on your site they should not be allowed to (up to and including 1.7.1052)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 1.7.1052
Fixed in
1.7.1053
What to do
If your site has an affected version, update Royal Addons for Elementor to version 1.7.1053 or newer.
Official ID
CVE-2026-28135
Report title
Royal Addons for Elementor – Addons and Templates Kit for Elementor <= 1.7.1052 - Missing Authorization
First reported
Sources
This week

A stranger could do things on your site they should not be allowed to (up to and including 1.7.1036)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 1.7.1036
Fixed in
1.7.1037
What to do
If your site has an affected version, update Royal Addons for Elementor to version 1.7.1037 or newer.
Official ID
CVE-2025-11363
Report title
Royal Elementor Addons and Templates <= 1.7.1036 - Missing Authorization to Unauthenticated Media File Upload
First reported
Sources
This week

Someone with a contributor account on your site could plant harmful code that runs for your visitors or admins (up to and including 1.7.1031)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 1.7.1031
Fixed in
1.7.1032
What to do
If your site has an affected version, update Royal Addons for Elementor to version 1.7.1032 or newer.
Official ID
CVE-2025-5092
Report title
Multiple Plugins and Themes <= (Various Versions) - Authenticated (Contributor+) DOM-Based Stored Cross-Site Scripting via lightGallery JavaScript Library
First reported
Sources
This week

Someone with a contributor account on your site could plant harmful code that runs for your visitors or admins (up to and including 1.7.1036)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 1.7.1036
Fixed in
1.7.1037
What to do
If your site has an affected version, update Royal Addons for Elementor to version 1.7.1037 or newer.
Official ID
CVE-2025-6251
Report title
Royal Elementor Addons and Templates <= 1.7.1036 - Authenticated (Contributor+) Stored Cross-Site Scripting
First reported
Sources
This week

Someone with a contributor account on your site could plant harmful code that runs for your visitors or admins (up to and including 1.7.1028)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 1.7.1028
Fixed in
1.7.1029
What to do
If your site has an affected version, update Royal Addons for Elementor to version 1.7.1029 or newer.
Official ID
CVE-2025-5338
Report title
Royal Elementor Addons <= 1.7.1028 - Authenticated (Contributor+) Stored DOM-Based Cross-Site Scripting via Multiple Widgets
First reported
Sources
This week

Someone with a contributor account on your site could plant harmful code that runs for your visitors or admins (up to and including 1.7.1020)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 1.7.1020
Fixed in
1.7.1021
What to do
If your site has an affected version, update Royal Addons for Elementor to version 1.7.1021 or newer.
Official ID
CVE-2025-3813
Report title
Royal Elementor Addons and Templates <= 1.7.1020 - Authenticated (Contributor+) Stored Cross-Site Scripting
First reported
Sources
This week

Someone with a contributor account on your site could plant harmful code that runs for your visitors or admins (up to and including 1.7.1017)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 1.7.1017
Fixed in
1.7.1018
What to do
If your site has an affected version, update Royal Addons for Elementor to version 1.7.1018 or newer.
Official ID
CVE-2025-39361
Report title
Royal Elementor Addons <= 1.7.1017 - Authenticated (Contributor+) Stored Cross-Site Scripting
First reported
Sources
This week

Someone with a contributor account on your site could plant harmful code that runs for your visitors or admins (up to and including 1.7.1017) (2)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 1.7.1017
Fixed in
1.7.1018
What to do
If your site has an affected version, update Royal Addons for Elementor to version 1.7.1018 or newer.
Official ID
CVE-2024-12120
Report title
Royal Elementor Addons and Templates <= 1.7.1017 - Authenticated (Contributor+) Stored Cross-Site Scripting
First reported
Sources
This week

Someone with a contributor account on your site could plant harmful code that runs for your visitors or admins (up to and including 1.3.977)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 1.3.977
Fixed in
1.3.979
What to do
If your site has an affected version, update Royal Addons for Elementor to version 1.3.979 or newer.
Official ID
CVE-2025-39543
Report title
Royal Elementor Addons <= 1.3.977 - Authenticated (Contributor+) Stored Cross-Site Scripting
First reported
Sources
This week

Someone could use it to harm your site (up to and including 1.7.1006)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 1.7.1006
Fixed in
1.7.1007
What to do
If your site has an affected version, update Royal Addons for Elementor to version 1.7.1007 or newer.
Official ID
CVE-2025-26990
Report title
Royal Elementor Addons <= 1.7.1006 - Authenticated (Admin+) Server Side Request Forgery
First reported
Sources
This week

Someone with a contributor account on your site could plant harmful code that runs for your visitors or admins (up to and including 1.7.1012)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 1.7.1012
Fixed in
1.7.1013
What to do
If your site has an affected version, update Royal Addons for Elementor to version 1.7.1013 or newer.
Official ID
CVE-2025-1455
Report title
Royal Elementor Addons and Templates <= 1.7.1012 - Authenticated (Contributor+) Stored Cross-Site Scripting
First reported
Sources
This week

Someone with a contributor account on your site could plant harmful code that runs for your visitors or admins (up to and including 1.7.1012) (2)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 1.7.1012
Fixed in
1.7.1013
What to do
If your site has an affected version, update Royal Addons for Elementor to version 1.7.1013 or newer.
Official ID
CVE-2025-1456
Report title
Royal Elementor Addons and Templates <= 1.7.1012 - Authenticated DOM-Based (Contributor+) Stored Cross-Site Scripting
First reported
Sources
This week

Someone could plant harmful code that runs for your visitors or admins (up to and including 1.7.1007)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 1.7.1007
Fixed in
1.7.1008
What to do
If your site has an affected version, update Royal Addons for Elementor to version 1.7.1008 or newer.
Official ID
CVE-2025-1441
Report title
Royal Elementor Addons and Templates <= 1.7.1007 - Cross-Site Request Forgery to Reflected Cross-Site Scripting
First reported
Sources
This week

Someone could plant harmful code that runs for your visitors or admins (up to and including 1.7.1006)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 1.7.1006
Fixed in
1.7.1007
What to do
If your site has an affected version, update Royal Addons for Elementor to version 1.7.1007 or newer.
Official ID
CVE-2025-0393
Report title
Royal Elementor Addons and Templates <= 1.7.1006 - Cross-Site Request Forgery to Reflected Cross-Site Scripting
First reported
Sources
This week

Someone could plant harmful code that runs for your visitors or admins (up to and including 1.7.1001)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 1.7.1001
Fixed in
1.7.1002
What to do
If your site has an affected version, update Royal Addons for Elementor to version 1.7.1002 or newer.
Official ID
CVE-2024-56226
Report title
Royal Elementor Addons <= 1.7.1001 - Reflected Cross-Site Scripting
First reported
Sources
This week

Someone could do things on your site they should not be allowed to (up to and including 1.7.1001)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 1.7.1001
Fixed in
1.7.1002
What to do
If your site has an affected version, update Royal Addons for Elementor to version 1.7.1002 or newer.
Official ID
CVE-2024-56227
Report title
Royal Elementor Addons <= 1.7.1001 - Missing Authorization
First reported
Sources
This week

Someone with a contributor account on your site could plant harmful code that runs for your visitors or admins (up to and including 1.3.987)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 1.3.987
Fixed in
1.7.1
What to do
If your site has an affected version, update Royal Addons for Elementor to version 1.7.1 or newer.
Official ID
CVE-2024-56062
Report title
Royal Elementor Addons <= 1.3.987 - Authenticated (Contributor+) Stored Cross-Site Scripting
First reported
Sources
This week

Someone with a contributor account on your site could use it to harm your site (up to and including 1.7.1003)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 1.7.1003
Fixed in
1.7.1004
What to do
If your site has an affected version, update Royal Addons for Elementor to version 1.7.1004 or newer.
Official ID
CVE-2024-10798
Report title
Royal Elementor Addons and Templates <= 1.7.1003 - Authenticated (Contributor+) Post Disclosure
First reported
Sources
This week

Someone with a contributor account on your site could plant harmful code that runs for your visitors or admins (up to and including 1.7.1001)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 1.7.1001
Fixed in
1.7.1002
What to do
If your site has an affected version, update Royal Addons for Elementor to version 1.7.1002 or newer.
Official ID
CVE-2024-9059
Report title
Royal Elementor Addons and Template <= 1.7.1001 - Authenticated (Contributor+) DOM-Based Stored Cross-Site Scripting via Google Maps Widget
First reported
Sources
This week

Someone with a contributor account on your site could plant harmful code that runs for your visitors or admins (up to and including 1.7.1001) (2)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 1.7.1001
Fixed in
1.7.1002
What to do
If your site has an affected version, update Royal Addons for Elementor to version 1.7.1002 or newer.
Official ID
CVE-2024-9668
Report title
Royal Elementor Addons and Templates <= 1.7.1001 - Authenticated (Contributor+) Stored Cross-Site Scripting via Countdown Widget
First reported
Sources
This week

Someone with a contributor account on your site could plant harmful code that runs for your visitors or admins (up to and including 1.7.1001) (3)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 1.7.1001
Fixed in
1.7.1002
What to do
If your site has an affected version, update Royal Addons for Elementor to version 1.7.1002 or newer.
Official ID
CVE-2024-9682
Report title
Royal Elementor Addons and Templates <= 1.7.1001 - Authenticated (Contributor+) DOM-Based Stored Cross-Site Scripting via Form Builder Widget
First reported
Sources
This week

Someone with an author account on your site could use it to harm your site

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 1.3.980
Fixed in
1.3.981
What to do
If your site has an affected version, update Royal Addons for Elementor to version 1.3.981 or newer.
Official ID
CVE-2024-50442
Report title
Royal Elementor Addons <= 1.3.980 - Authenticated (Author+) External Entity Injection
First reported
Sources
This week

Anyone with an account on your site, even a basic one could use it to harm your site (up to and including 1.3.986)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 1.3.986
Fixed in
1.3.987
What to do
If your site has an affected version, update Royal Addons for Elementor to version 1.3.987 or newer.
Official ID
CVE-2024-7417
Report title
Royal Elementor Addons and Templates <= 1.3.986 - Authenticated (Subscriber+) Private Post Disclosure
First reported
Sources
This week

Someone with a contributor account on your site could plant harmful code that runs for your visitors or admins (up to and including 1.3.986)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 1.3.986
Fixed in
1.3.987
What to do
If your site has an affected version, update Royal Addons for Elementor to version 1.3.987 or newer.
Official ID
CVE-2024-8482
Report title
Royal Elementor Addons and Templates <= 1.3.986 - Authenticated (Contributor+) Stored Cross-Site Scripting via Team Member Widget
First reported
Sources
This week

Someone with a contributor account on your site could plant harmful code that runs for your visitors or admins (up to and including 1.3.982)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 1.3.982
Fixed in
1.3.985
What to do
If your site has an affected version, update Royal Addons for Elementor to version 1.3.985 or newer.
Official ID
CVE-2024-44001
Report title
Royal Elementor Addons <= 1.3.982 - Authenticated (Contributor+) Stored Cross-Site Scripting
First reported
Sources
This week

Someone with a contributor account on your site could plant harmful code that runs for your visitors or admins (up to and including 1.3.980)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 1.3.980
Fixed in
1.3.981
What to do
If your site has an affected version, update Royal Addons for Elementor to version 1.3.981 or newer.
Official ID
CVE-2024-5818
Report title
Royal Elementor Addons and Templates <= 1.3.980 - Authenticated (Contributor+) DOM-Based Stored Cross-Site Scripting via Magazine Grid/Slider Widget
First reported
Sources
This week

Someone with an author account on your site could plant harmful code that runs for your visitors or admins (up to and including 1.3.976)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 1.3.976
Fixed in
1.3.977
What to do
If your site has an affected version, update Royal Addons for Elementor to version 1.3.977 or newer.
Official ID
CVE-2024-4489
Report title
Royal Elementor Addons and Templates <= 1.3.976 - Authenticated (Author+) Stored Cross-Site Scripting via SVG Uploads
First reported
Sources
This week

Someone with a contributor account on your site could plant harmful code that runs for your visitors or admins (up to and including 1.3.976)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 1.3.976
Fixed in
1.3.977
What to do
If your site has an affected version, update Royal Addons for Elementor to version 1.3.977 or newer.
Official ID
CVE-2024-4488
Report title
Royal Elementor Addons and Templates <= 1.3.976 - Authenticated (Contributor+) Stored Cross-Site Scripting
First reported
Sources
This week

Someone with a contributor account on your site could plant harmful code that runs for your visitors or admins (up to and including 1.3.975)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 1.3.975
Fixed in
1.3.976
What to do
If your site has an affected version, update Royal Addons for Elementor to version 1.3.976 or newer.
Official ID
CVE-2024-4087
Report title
Royal Elementor Addons and Templates <= 1.3.975 - Authenticated (Contributor+) Stored Cross-Site Scripting via Back to Top Widget
First reported
Sources
This week

Someone with a contributor account on your site could plant harmful code that runs for your visitors or admins (up to and including 1.3.975) (2)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 1.3.975
Fixed in
1.3.976
What to do
If your site has an affected version, update Royal Addons for Elementor to version 1.3.976 or newer.
Official ID
CVE-2024-4342
Report title
Royal Elementor Addons and Templates <= 1.3.975 - Authenticated (Contributor+) Stored Cross-Site Scripting
First reported
Sources
This week

Someone with a contributor account on your site could plant harmful code that runs for your visitors or admins (up to and including 1.3.974)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 1.3.974
Fixed in
1.3.975
What to do
If your site has an affected version, update Royal Addons for Elementor to version 1.3.975 or newer.
Official ID
CVE-2024-3887
Report title
Royal Elementor Addons and Templates <= 1.3.974 - Authenticated (Contributor+) Stored Cross-Site Scripting via Form Builder Widget
First reported
Sources
This week

A stranger could use it to harm your site (up to and including 1.3.93)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 1.3.93
Fixed in
1.3.95
What to do
If your site has an affected version, update Royal Addons for Elementor to version 1.3.95 or newer.
Official ID
CVE-2024-32786
Report title
Royal Elementor Addons <= 1.3.93 - Unauthenticated IP Spoofing
First reported
Sources
This week

Someone with a contributor account on your site could plant harmful code that runs for your visitors or admins (up to and including 1.3.971)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 1.3.971
Fixed in
1.3.972
What to do
If your site has an affected version, update Royal Addons for Elementor to version 1.3.972 or newer.
Official ID
CVE-2024-3675
Report title
Royal Elementor Addons and Templates <= 1.3.971 - Authenticated (Contributor+) Stored Cross-Site Scripting via Flip Carousel, Flip Box, Post Grid, and Taxonomy List Widget Attributes
First reported
Sources
This week

Someone with a contributor account on your site could plant harmful code that runs for your visitors or admins (up to and including 1.3.971) (2)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 1.3.971
Fixed in
1.3.972
What to do
If your site has an affected version, update Royal Addons for Elementor to version 1.3.972 or newer.
Official ID
CVE-2024-2799
Report title
Royal Elementor Addons and Templates <= 1.3.971 - Authenticated (Contributor+) Stored Cross-Site Scripting via HTML Tags
First reported
Sources
This week

Someone with a contributor account on your site could plant harmful code that runs for your visitors or admins (up to and including 1.3.971) (3)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 1.3.971
Fixed in
1.3.972
What to do
If your site has an affected version, update Royal Addons for Elementor to version 1.3.972 or newer.
Official ID
CVE-2024-2798
Report title
Royal Elementor Addons and Templates <= 1.3.971 - Authenticated (Contributor+) DOM-Based Stored Cross-Site Scripting
First reported
Sources
This week

Someone with a contributor account on your site could plant harmful code that runs for your visitors or admins (up to and including 1.3.971) (4)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 1.3.971
Fixed in
1.3.972
What to do
If your site has an affected version, update Royal Addons for Elementor to version 1.3.972 or newer.
Official ID
CVE-2024-3889
Report title
Royal Elementor Addons and Templates <= 1.3.971 - Authenticated (Contributor+) Stored Cross-Site Scripting via Advanced Accordion Title Tags
First reported
Sources
This week

A stranger could use it to harm your site (up to and including 1.3.94)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 1.3.94
Fixed in
1.3.95
What to do
If your site has an affected version, update Royal Addons for Elementor to version 1.3.95 or newer.
Official ID
CVE-2024-1567
Report title
Royal Elementor Addons and Templates <= 1.3.94 - Unauthenticated Limited File Upload
First reported
Sources
This week

Someone with a contributor account on your site could use it to harm your site (up to and including 1.3.93)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 1.3.93
Fixed in
1.3.95
What to do
If your site has an affected version, update Royal Addons for Elementor to version 1.3.95 or newer.
Official ID
CVE-2024-31236
Report title
Royal Elementor Addons <= 1.3.93 - Authenticated (Contributor+) Stored Cross-Site Scriting
First reported
Sources
This week

Someone with a contributor account on your site could plant harmful code that runs for your visitors or admins (up to and including 1.3.91)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 1.3.91
Fixed in
1.3.92
What to do
If your site has an affected version, update Royal Addons for Elementor to version 1.3.92 or newer.
Official ID
CVE-2024-1500
Report title
Royal Elementor Addons and Templates <= 1.3.91 - Authenticated (Contributor+) Stored Cross-Site Scripting via Logo Widget
First reported
Sources
This week

Someone with a contributor account on your site could plant harmful code that runs for your visitors or admins (up to and including 1.3.87)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 1.3.87
Fixed in
1.3.88
What to do
If your site has an affected version, update Royal Addons for Elementor to version 1.3.88 or newer.
Official ID
CVE-2024-0442
Report title
Royal Elementor Addons and Templates <= 1.3.87 - Authenticated (Contributor+) Stored Cross-Site Scripting
First reported
Sources
This week

Someone could trick a logged-in admin into changing settings without knowing (up to and including 1.3.87)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 1.3.87
Fixed in
1.3.88
What to do
If your site has an affected version, update Royal Addons for Elementor to version 1.3.88 or newer.
Official ID
CVE-2024-0513
Report title
Royal Elementor Addons and Templates <= 1.3.87 - Cross-Site Request Forgery via remove_from_wishlist
First reported
Sources
This week

Someone could trick a logged-in admin into changing settings without knowing (up to and including 1.3.87) (2)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 1.3.87
Fixed in
1.3.88
What to do
If your site has an affected version, update Royal Addons for Elementor to version 1.3.88 or newer.
Official ID
CVE-2024-0515
Report title
Royal Elementor Addons and Templates <= 1.3.87 - Cross-Site Request Forgery via remove_from_compare
First reported
Sources
This week

Someone could trick a logged-in admin into changing settings without knowing (up to and including 1.3.87) (3)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 1.3.87
Fixed in
1.3.88
What to do
If your site has an affected version, update Royal Addons for Elementor to version 1.3.88 or newer.
Official ID
CVE-2024-0514
Report title
Royal Elementor Addons and Templates <= 1.3.87 - Cross-Site Request Forgery via add_to_compare
First reported
Sources
This week

Someone could trick a logged-in admin into changing settings without knowing (up to and including 1.3.87) (4)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 1.3.87
Fixed in
1.3.88
What to do
If your site has an affected version, update Royal Addons for Elementor to version 1.3.88 or newer.
Official ID
CVE-2024-0512
Report title
Royal Elementor Addons and Templates <= 1.3.87 - Cross-Site Request Forgery via add_to_wishlist
First reported
Sources
This week

Someone could do things on your site they should not be allowed to (up to and including 1.3.87)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 1.3.87
Fixed in
1.3.88
What to do
If your site has an affected version, update Royal Addons for Elementor to version 1.3.88 or newer.
Official ID
CVE-2024-0516
Report title
Royal Elementor Addons and Templates <= 1.3.87 - Missing Authorization via wpr_update_form_action_meta
First reported
Sources
This week

Someone could trick a logged-in admin into changing settings without knowing (up to and including 1.3.87) (5)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 1.3.87
Fixed in
1.3.88
What to do
If your site has an affected version, update Royal Addons for Elementor to version 1.3.88 or newer.
Official ID
CVE-2024-0511
Report title
Royal Elementor Addons and Templates <= 1.3.87 - Cross-Site Request Forgery via wpr_update_form_action_meta
First reported
Sources
This week

Someone could do things on your site they should not be allowed to (up to and including 1.3.80)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 1.3.80
Fixed in
1.3.81
What to do
If your site has an affected version, update Royal Addons for Elementor to version 1.3.81 or newer.
Official ID
CVE-2023-5922
Report title
Royal Elementor Addons and Templates <= 1.3.80 - Missing Authorization to Private/Password Protected Post Read
First reported
Sources
This week

A stranger could run their own code on your site and take it over

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 1.3.78
Fixed in
1.3.79
What to do
If your site has an affected version, update Royal Addons for Elementor to version 1.3.79 or newer.
Official ID
CVE-2023-5360
Report title
Royal Elementor Addons and Templates <= 1.3.78 - Unauthenticated Arbitrary File Upload
First reported
Sources
This week

Someone could trick a logged-in admin into changing settings without knowing (up to and including 1.3.75)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 1.3.75
Fixed in
1.3.76
What to do
If your site has an affected version, update Royal Addons for Elementor to version 1.3.76 or newer.
Official ID
CVE-2022-47175
Report title
Royal Elementor Addons <= 1.3.75 - Cross-Site Request Forgery
First reported
Sources
This week

Someone could plant harmful code that runs for your visitors or admins (from 1.3 up to and including 1.3.70)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • From 1.3 up to and including 1.3.70
Fixed in
1.3.71
What to do
If your site has an affected version, update Royal Addons for Elementor to version 1.3.71 or newer.
Official ID
CVE-2023-33999
Report title
Freemius SDK <= 2.5.9 - Reflected Cross-Site Scripting via fs_request_get
First reported
Sources
This week

A stranger could use it to harm your site (up to and including 1.3.70)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 1.3.70
Fixed in
1.3.71
What to do
If your site has an affected version, update Royal Addons for Elementor to version 1.3.71 or newer.
Official ID
CVE-2023-3709
Report title
Royal Elementor Addons <=1.3.70 - Unauthenticated MailChimp API Key Disclosure
First reported
Sources
This week

Someone could use it to harm your site (up to and including 1.3.59)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 1.3.59
Fixed in
1.3.60
What to do
If your site has an affected version, update Royal Addons for Elementor to version 1.3.60 or newer.
Official ID
CVE-2022-4705
Report title
Royal Elementor Addons <= 1.3.59 - Insufficient Access Control to Template Activation
First reported
Sources
This week

Someone could trick a logged-in admin into changing settings without knowing (up to and including 1.3.59)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 1.3.59
Fixed in
1.3.60
What to do
If your site has an affected version, update Royal Addons for Elementor to version 1.3.60 or newer.
Official ID
CVE-2022-4707
Report title
Royal Elementor Addons <= 1.3.59 - Cross-Site Request Forgery to Menu Template creation
First reported
Sources
This week

Someone could use it to harm your site (up to and including 1.3.59) (2)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 1.3.59
Fixed in
1.3.60
What to do
If your site has an affected version, update Royal Addons for Elementor to version 1.3.60 or newer.
Official ID
CVE-2022-4701
Report title
Royal Elementor Addons <= 1.3.59 - Insufficient Access Control to Plugin Activation
First reported
Sources
This week

Someone could use it to harm your site (up to and including 1.3.59) (3)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 1.3.59
Fixed in
1.3.60
What to do
If your site has an affected version, update Royal Addons for Elementor to version 1.3.60 or newer.
Official ID
CVE-2022-4703
Report title
Royal Elementor Addons <= 1.3.59 - Insufficient Access Control to Import Deletion
First reported
Sources
This week

Someone could use it to harm your site (up to and including 1.3.59) (4)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 1.3.59
Fixed in
1.3.60
What to do
If your site has an affected version, update Royal Addons for Elementor to version 1.3.60 or newer.
Official ID
CVE-2022-4704
Report title
Royal Elementor Addons <= 1.3.59 - Insufficient Access Control to Template Import
First reported
Sources
This week

Someone could plant harmful code that runs for your visitors or admins (up to and including 1.3.59)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 1.3.59
Fixed in
1.3.60
What to do
If your site has an affected version, update Royal Addons for Elementor to version 1.3.60 or newer.
Official ID
CVE-2022-4710
Report title
Royal Elementor Addons <= 1.3.59 - Reflected Cross-Site Scripting
First reported
Sources
This week

Someone could use it to harm your site (up to and including 1.3.59) (5)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 1.3.59
Fixed in
1.3.60
What to do
If your site has an affected version, update Royal Addons for Elementor to version 1.3.60 or newer.
Official ID
CVE-2022-4708
Report title
Royal Elementor Addons <= 1.3.59 - Insufficient Access Control to Template Conditions Modification
First reported
Sources
This week

Someone could use it to harm your site (up to and including 1.3.59) (6)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 1.3.59
Fixed in
1.3.60
What to do
If your site has an affected version, update Royal Addons for Elementor to version 1.3.60 or newer.
Official ID
CVE-2022-4711
Report title
Royal Elementor Addons <= 1.3.59 - Insufficient Access Control to Menu Settings Update
First reported
Sources
This week

Someone could use it to harm your site (up to and including 1.3.59) (7)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 1.3.59
Fixed in
1.3.60
What to do
If your site has an affected version, update Royal Addons for Elementor to version 1.3.60 or newer.
Official ID
CVE-2022-4702
Report title
Royal Elementor Addons <= 1.3.59 - Insufficient Access Control to Plugin Deactivation
First reported
Sources
This week

Someone could use it to harm your site (up to and including 1.3.59) (8)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 1.3.59
Fixed in
1.3.60
What to do
If your site has an affected version, update Royal Addons for Elementor to version 1.3.60 or newer.
Official ID
CVE-2022-4700
Report title
Royal Elementor Addons <= 1.3.59 - Insufficient Access Control to Theme Activation
First reported
Sources
This week

Someone could use it to harm your site (up to and including 1.3.59) (9)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 1.3.59
Fixed in
1.3.60
What to do
If your site has an affected version, update Royal Addons for Elementor to version 1.3.60 or newer.
Official ID
CVE-2022-4709
Report title
Royal Elementor Addons <= 1.3.59 - Insufficient Access Control to Template Kit Import
First reported
Sources
This week

Someone could trick a logged-in admin into changing settings without knowing (up to and including 1.3.55)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 1.3.55
Fixed in
1.3.56
What to do
If your site has an affected version, update Royal Addons for Elementor to version 1.3.56 or newer.
Official ID
CVE-2022-4102
Report title
Royal Elementor Addons <= 1.3.55 - Cross-Site Request Forgery
First reported
Sources
This week

Anyone with an account on your site, even a basic one could use it to harm your site (up to and including 1.3.55)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 1.3.55
Fixed in
1.3.56
What to do
If your site has an affected version, update Royal Addons for Elementor to version 1.3.56 or newer.
Official ID
CVE-2022-4102
Report title
Royal Elementor Addons <=1.3.55 - Authenticated (Subscriber+) Arbitrary Post Deletion
First reported
Sources
This week

Someone could do things on your site they should not be allowed to (up to and including 1.3.55)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 1.3.55
Fixed in
1.3.56
What to do
If your site has an affected version, update Royal Addons for Elementor to version 1.3.56 or newer.
Official ID
CVE-2022-4103
Report title
Royal Elementor Addons <=1.3.55 - Missing Authorization to Subscriber+ Arbitrary Post Creation
First reported
Sources
This week

Someone could trick a logged-in admin into changing settings without knowing (up to and including 1.3.55) (2)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 1.3.55
Fixed in
1.3.56
What to do
If your site has an affected version, update Royal Addons for Elementor to version 1.3.56 or newer.
Report title
Royal Elementor Addons <= 1.3.55 - Cross-Site Request Forgery
First reported
Sources
This week

Someone could do things on your site they should not be allowed to (before 1.3.33)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Before 1.3.33
Fixed in
1.3.33
What to do
If your site has an affected version, update Royal Addons for Elementor to version 1.3.33 or newer.
Official ID
CVE-2022-4974
Report title
Freemius SDK <= 2.4.2 - Missing Authorization Checks
First reported
Sources

Where this comes from

We collect these reports from public security sources and rewrite them in plain words. Each problem shows its sources and the date we first saw it. This page never says whether your own site is affected: only a check of your site’s versions can tell.

All plugins and themes

Get an email when your site is affected.

Install Watchfox AI once. It checks your plugins and themes against this list every day, for free.

Install Watchfox AI (free)