WordPress Royal Addons for Elementor plugin < 1.7.1066 - Contributor+ Stored XSS vulnerability

Contributor+ Stored XSS vulnerability discovered by Erwan LR WPScan in WordPress Plugin Royal Elementor Addons versions 1.7.1066...

CVE-2026-19226 Royal Elementor Addons < 1.7.1066 - Contributor+ Stored XSS via Image Accordion Widget Effect Settings

The Royal Addons for Elementor WordPress plugin before 1.7.1066 does not validate some widget settings before outputting them inside an HTML attribute, which could allow users with the Contributor role and above to perform Stored Cross-Site Scripting attacks...

CVE-2026-13406

The Royal Addons for Elementor WordPress plugin, in versions prior to 1.7.1066 , is vulnerable to an unauthenticated taxonomy term disclosure . The root cause is a lack of capability or nonce checks when returning taxonomy term data for an arbitrary, caller-supplied taxonomy. This flaw allows una...

CVE-2026-13406 Royal Elementor Addons < 1.7.1066 - Unauthenticated Taxonomy Term Disclosure

The Royal Addons for Elementor WordPress plugin before 1.7.1066 does not perform any capability or nonce check before returning taxonomy term data for an arbitrary, caller-supplied taxonomy, allowing unauthenticated users to disclose the names and IDs of terms belonging to non-public taxonomies...

CVE-2026-13404

The Royal Addons for Elementor WordPress plugin (versions before 1.7.1066 ) is vulnerable to an authorization bypass. The software fails to perform proper capability or ownership checks when writing like-count and visitor-tracking post meta, relying instead on a publicly-scrapeable nonce . This f...

EUVD-2026-66266

The Royal Addons for Elementor WordPress plugin before 1.7.1066 does not perform any capability or ownership check relying only on a publicly-scrapeable nonce before writing like-count and visitor-tracking post meta keyed on an arbitrary post ID, allowing unauthenticated users to modify that...

CVE-2026-13406 Royal Elementor Addons < 1.7.1066 - Unauthenticated Taxonomy Term Disclosure

The Royal Addons for Elementor WordPress plugin before 1.7.1066 does not perform any capability or nonce check before returning taxonomy term data for an arbitrary, caller-supplied taxonomy, allowing unauthenticated users to disclose the names and IDs of terms belonging to non-public taxonomies...

CVE-2026-13404 Royal Elementor Addons < 1.7.1066 - Unauthenticated Like Count and IP Meta Modification via wpr_likes_init

The Royal Addons for Elementor WordPress plugin before 1.7.1066 does not perform any capability or ownership check relying only on a publicly-scrapeable nonce before writing like-count and visitor-tracking post meta keyed on an arbitrary post ID, allowing unauthenticated users to modify that...

CVE-2026-13404 Royal Elementor Addons < 1.7.1066 - Unauthenticated Like Count and IP Meta Modification via wpr_likes_init

The Royal Addons for Elementor WordPress plugin before 1.7.1066 does not perform any capability or ownership check relying only on a publicly-scrapeable nonce before writing like-count and visitor-tracking post meta keyed on an arbitrary post ID, allowing unauthenticated users to modify that...

CVE-2026-19226: Improper Neutralization of Input During Web Page Generation

The Royal Addons for Elementor WordPress plugin before 1.7.1066 does not validate some widget settings before outputting them inside an HTML attribute, which could allow users with the Contributor role and above to perform Stored Cross-Site Scripting attacks...

CVE-2026-13406: Missing Authorization

The Royal Addons for Elementor WordPress plugin before 1.7.1066 does not perform any capability or nonce check before returning taxonomy term data for an arbitrary, caller-supplied taxonomy, allowing unauthenticated users to disclose the names and IDs of terms belonging to non-public taxonomies...

CVE-2026-13404: Authorization Bypass Through User-Controlled Key

The Royal Addons for Elementor WordPress plugin before 1.7.1066 does not perform any capability or ownership check relying only on a publicly-scrapeable nonce before writing like-count and visitor-tracking post meta keyed on an arbitrary post ID, allowing unauthenticated users to modify that...

PT-2026-81944

The Royal Addons for Elementor WordPress plugin before 1.7.1066 does not perform any capability or nonce check before returning taxonomy term data for an arbitrary, caller-supplied taxonomy, allowing unauthenticated users to disclose the names and IDs of terms belonging to non-public taxonomies...

PT-2026-81954

The Royal Addons for Elementor WordPress plugin before 1.7.1066 does not validate some widget settings before outputting them inside an HTML attribute, which could allow users with the Contributor role and above to perform Stored Cross-Site Scripting attacks...

CVE-2026-75971

The ShopEngine Elementor WooCommerce Builder Addon WordPress plugin is vulnerable to privilege escalation in versions up to and including 4.9.4 . The root cause is the rum_importer() function registered on the import_start action hook without a plugin-owned capability check or allowlist filtering...

CVE-2026-75971 ShopEngine Elementor WooCommerce Builder Addon <= 4.9.4 - Authenticated (Shop Manager+) Privilege Escalation to WXR Import '<wp_option>' Nodes

The ShopEngine Elementor WooCommerce Builder Addon – All in One WooCommerce Solution plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 4.9.4. This is due to the rumimporter function being registered on the WordPress core importstart action hook with ...

EUVD-2026-65462

The ShopEngine Elementor WooCommerce Builder Addon – All in One WooCommerce Solution plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 4.9.4. This is due to the rumimporter function being registered on the WordPress core importstart action hook with ...

CVE-2026-75971 ShopEngine Elementor WooCommerce Builder Addon <= 4.9.4 - Authenticated (Shop Manager+) Privilege Escalation to WXR Import '<wp_option>' Nodes

The ShopEngine Elementor WooCommerce Builder Addon – All in One WooCommerce Solution plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 4.9.4. This is due to the rumimporter function being registered on the WordPress core importstart action hook with ...

CVE-2026-18100

The MetForm – Contact Form, Survey, Quiz, & Custom Form Builder for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'mfformid' Widget Setting in all versions up to, and including, 4.1.8 due to insufficient input sanitization and output escaping. This makes it...

CVE-2026-18100 MetForm <= 4.1.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'mf_form_id' Widget Setting

The MetForm – Contact Form, Survey, Quiz, & Custom Form Builder for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'mfformid' Widget Setting in all versions up to, and including, 4.1.8 due to insufficient input sanitization and output escaping. This makes it...