CVE-2026-40720 | High | 7.1 | 2026-06-17 | Unauthenticated Cross Site Scripting (XSS) in Royal Elementor Addons Pro < 1.7.1041 versions. |
CVE-2025-5338 | Medium | 6.4 | 2025-06-26 | The Royal Elementor Addons plugin for WordPress is vulnerable to Stored Cross-Site Scripting via multiple widgets in all versions up to, and including, 1.7.102… |
CVE-2025-3813 | Medium | 6.4 | 2025-05-31 | The Royal Elementor Addons and Templates plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘_elementor_data’ parameter in all versions… |
CVE-2025-39361 | Medium | 6.5 | 2025-05-07 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WP Royal Royal Elementor Addons royal-elementor-addons al… |
CVE-2024-12120 | Medium | 5.4 | 2025-05-07 | The Royal Elementor Addons and Templates plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Countdown widget display_message_text parame… |
CVE-2025-26990 | Medium | 4.4 | 2025-04-15 | Server-Side Request Forgery (SSRF) vulnerability in WP Royal Royal Elementor Addons royal-elementor-addons allows Server Side Request Forgery.This issue affect… |
CVE-2025-1456 | Medium | 6.4 | 2025-04-12 | The Royal Elementor Addons and Templates plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the `widgetGrid`, `widgetCountDown`, and `widget… |
CVE-2025-1455 | Medium | 6.4 | 2025-04-12 | The Royal Elementor Addons and Templates plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Woo Grid widget in all versions up to, and i… |
CVE-2025-1441 | Medium | 6.1 | 2025-02-19 | The Royal Elementor Addons and Templates plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.7.1007. This… |
CVE-2025-0393 | Medium | 6.1 | 2025-01-14 | The Royal Elementor Addons and Templates plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.7.1006. This… |
CVE-2024-56062 | Medium | 6.5 | 2024-12-31 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WP Royal Royal Elementor Addons royal-elementor-addons al… |
CVE-2024-56227 | Medium | 4.3 | 2024-12-31 | Missing Authorization vulnerability in WP Royal Royal Elementor Addons royal-elementor-addons allows Exploiting Incorrectly Configured Access Control Security… |
CVE-2024-56226 | High | 7.1 | 2024-12-31 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WP Royal Royal Elementor Addons royal-elementor-addons al… |
CVE-2024-10798 | Medium | 4.3 | 2024-11-28 | The Royal Elementor Addons and Templates plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 1.7.1003 via the 'wpr… |
CVE-2024-9682 | Medium | 6.4 | 2024-11-13 | The Royal Elementor Addons and Templates plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Form Builder widget in all versions… |
CVE-2024-9668 | Medium | 6.4 | 2024-11-13 | The Royal Elementor Addons and Templates plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Countdown widget in all versions up… |
CVE-2024-9059 | Medium | 6.4 | 2024-11-13 | The Royal Elementor Addons and Templates plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Google Maps widget in all versions up to, an… |
CVE-2024-50442 | Medium | 6.5 | 2024-10-28 | Improper Restriction of XML External Entity Reference vulnerability in WP Royal Royal Elementor Addons royal-elementor-addons allows XML Injection.This issue a… |
CVE-2024-7417 | Medium | 4.3 | 2024-10-17 | The Royal Elementor Addons and Templates plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 1.3.986 via the data_… |
CVE-2024-8482 | Medium | 6.4 | 2024-10-08 | The Royal Elementor Addons and Templates plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘url’ parameter in all versions up to, and i… |
CVE-2024-44001 | Medium | 6.5 | 2024-09-18 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WP Royal Royal Elementor Addons royal-elementor-addons.Th… |
CVE-2024-5818 | Medium | 6.4 | 2024-07-24 | The Royal Elementor Addons and Templates plugin for WordPress is vulnerable to Stored DOM-based Cross-Site Scripting via the plugin's Magazine Grid/Slider widg… |
CVE-2024-4489 | Medium | 6.4 | 2024-06-07 | The Royal Elementor Addons and Templates plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘custom_upload_mimes’ function in versions u… |
CVE-2024-4488 | Medium | 6.4 | 2024-06-07 | The Royal Elementor Addons and Templates for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘inline_list’ parameter in versions up to, and incl… |
CVE-2024-4342 | Medium | 6.4 | 2024-06-01 | The Royal Elementor Addons and Templates plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's image hotspot, image accordion, off… |
CVE-2024-4087 | Medium | 6.4 | 2024-06-01 | The Royal Elementor Addons and Templates plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Back to Top widget in all versions… |
CVE-2024-32786 | Medium | 5.3 | 2024-05-17 | Authentication Bypass by Spoofing vulnerability in WP Royal Royal Elementor Addons allows Functionality Bypass.This issue affects Royal Elementor Addons: from… |
CVE-2024-3887 | Medium | 5.4 | 2024-05-16 | The Royal Elementor Addons and Templates plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Form Builder widget in all versions up to, a… |
CVE-2024-3675 | Medium | 6.4 | 2024-05-02 | The Royal Elementor Addons and Templates plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Flip Carousel, Flip Box, Post Grid… |
CVE-2024-1567 | High | 8.2 | 2024-05-02 | The Royal Elementor Addons and Templates plugin for WordPress is vulnerable to limited file uploads due to missing file type validation in the 'file_validity'… |
CVE-2024-3889 | Medium | 6.4 | 2024-04-23 | The Royal Elementor Addons and Templates plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Advanced Accordion widget in all ve… |
CVE-2024-2799 | Medium | 6.4 | 2024-04-23 | The Royal Elementor Addons and Templates plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Image Grid & Advanced Text widget HTML tags… |
CVE-2024-2798 | Medium | 6.4 | 2024-04-23 | The Royal Elementor Addons and Templates plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's widget containers in all versions u… |
CVE-2024-31236 | Medium | 6.5 | 2024-04-07 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WP Royal Royal Elementor Addons allows Stored XSS.This is… |
CVE-2024-1500 | Medium | 5.4 | 2024-03-07 | The Royal Elementor Addons and Templates plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Logo Widget in all versions up to, and inclu… |
CVE-2024-0516 | Medium | 5.3 | 2024-02-29 | The Royal Elementor Addons and Templates plugin for WordPress is vulnerable to unauthorized post metadata update due to a missing capability check on the wpr_u… |
CVE-2024-0515 | Medium | 4.3 | 2024-02-29 | The Royal Elementor Addons and Templates plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.3.87. This is… |
CVE-2024-0514 | Medium | 4.3 | 2024-02-29 | The Royal Elementor Addons and Templates plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.3.87. This is… |
CVE-2024-0513 | Medium | 4.3 | 2024-02-29 | The Royal Elementor Addons and Templates plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.3.87. This is… |
CVE-2024-0512 | Medium | 4.3 | 2024-02-29 | The Royal Elementor Addons and Templates plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.3.87. This is… |
CVE-2024-0442 | Medium | 6.4 | 2024-02-29 | The Royal Elementor Addons and Templates plugin for WordPress is vulnerable to Stored Cross-Site Scripting via element URL parameters in all versions up to, an… |
CVE-2024-0511 | Medium | 4.3 | 2024-02-08 | The Royal Elementor Addons and Templates plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.3.87. This is… |
CVE-2024-0835 | Medium | 4.3 | 2024-02-05 | The Royal Elementor Kit theme for WordPress is vulnerable to unauthorized arbitrary transient update due to a missing capability check on the dismissed_handler… |
CVE-2023-5922 | High | 7.5 | 2024-01-16 | The Royal Elementor Addons and Templates WordPress plugin before 1.3.81 does not ensure that users accessing posts via an AJAX action (and REST endpoint, curre… |
CVE-2023-5360 | Critical | 9.8 | 2023-10-31 | The Royal Elementor Addons and Templates WordPress plugin before 1.3.79 does not properly validate uploaded files, which could allow unauthenticated users to u… |
CVE-2022-47175 | Medium | 4.3 | 2023-10-06 | Cross-Site Request Forgery (CSRF) vulnerability in P Royal Royal Elementor Addons and Templates plugin <= 1.3.75 versions. |
CVE-2023-3709 | Medium | 5.3 | 2023-07-18 | The Royal Elementor Addons plugin for WordPress is vulnerable to unauthenticated API key disclosure in versions up to, and including, 1.3.70 due to the plugin… |
CVE-2022-4711 | Medium | 4.3 | 2023-01-10 | The Royal Elementor Addons plugin for WordPress is vulnerable to insufficient access control in the 'wpr_save_mega_menu_settings' AJAX action in versions up to… |
CVE-2022-4710 | Medium | 6.1 | 2023-01-10 | The Royal Elementor Addons plugin for WordPress is vulnerable to Reflected Cross-Site Scripting in versions up to, and including, 1.3.59, due to due to insuffi… |
CVE-2022-4709 | Medium | 4.3 | 2023-01-10 | The Royal Elementor Addons plugin for WordPress is vulnerable to insufficient access control in the 'wpr_import_library_template' AJAX action in versions up to… |
CVE-2022-4708 | Medium | 4.3 | 2023-01-10 | The Royal Elementor Addons plugin for WordPress is vulnerable to insufficient access control in the 'wpr_save_template_conditions' AJAX action in versions up t… |
CVE-2022-4707 | Medium | 4.3 | 2023-01-10 | The Royal Elementor Addons plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.3.59. This is due to missing no… |
CVE-2022-4705 | Medium | 4.3 | 2023-01-10 | The Royal Elementor Addons plugin for WordPress is vulnerable to insufficient access control in the 'wpr_final_settings_setup' AJAX action in versions up to, a… |
CVE-2022-4704 | Medium | 5.4 | 2023-01-10 | The Royal Elementor Addons plugin for WordPress is vulnerable to insufficient access control in the 'wpr_import_templates_kit' AJAX action in versions up to, a… |
CVE-2022-4703 | Medium | 4.3 | 2023-01-10 | The Royal Elementor Addons plugin for WordPress is vulnerable to insufficient access control in the 'wpr_reset_previous_import' AJAX action in versions up to… |
CVE-2022-4702 | Medium | 5.4 | 2023-01-10 | The Royal Elementor Addons plugin for WordPress is vulnerable to insufficient access control in the 'wpr_fix_royal_compatibility' AJAX action in versions up to… |
CVE-2022-4701 | Medium | 4.3 | 2023-01-10 | The Royal Elementor Addons plugin for WordPress is vulnerable to insufficient access control in the 'wpr_activate_required_plugins' AJAX action in versions up… |
CVE-2022-4700 | Medium | 5.4 | 2023-01-10 | The Royal Elementor Addons plugin for WordPress is vulnerable to insufficient access control in the 'wpr_activate_required_theme' AJAX action in versions up to… |
CVE-2022-4103 | Medium | 4.3 | 2023-01-09 | The Royal Elementor Addons WordPress plugin before 1.3.56 does not have authorisation and CSRF checks when creating a template, and does not ensure that the po… |
CVE-2022-4102 | Low | 3.1 | 2023-01-09 | The Royal Elementor Addons WordPress plugin before 1.3.56 does not have authorization and CSRF checks when deleting a template and does not ensure that the pos… |