139 matches found
CVE-2026-107100
The Royal Addons for Elementor WordPress plugin before 1.7.1070 does not verify that a requested post is publicly viewable before returning its content via an unauthenticated AJAX action, relying only on the published status and not on the post type's visibility, allowing unauthenticated users to...
CVE-2026-107098
The Royal Addons for Elementor WordPress plugin before 1.7.1070 does not sanitise and escape one of its map widget's size settings before concatenating it into an HTML attribute, allowing users with the Contributor role or above to inject JavaScript that runs in the browser of any user who views...
CVE-2026-106647
The Royal Addons for Elementor WordPress plugin before 1.7.1070 does not scope a contact form's email delivery configuration to the form's own document or owner, instead storing it in a site-global namespace keyed only on a non-secret, author-chosen identifier that is exposed in public page sourc...
CVE-2026-107097
The Royal Addons for Elementor WordPress plugin before 1.7.1070 does not perform any authorization check before using the site owner's stored Mailchimp credential to add subscriber records to an audience chosen by the request, allowing unauthenticated attackers to inject arbitrary email addresses...
EUVD-2026-111708
The Royal Addons for Elementor WordPress plugin before 1.7.1070 does not verify that a requested post is publicly viewable before returning its content via an unauthenticated AJAX action, relying only on the published status and not on the post type's visibility, allowing unauthenticated users to...
EUVD-2026-111706
The Royal Addons for Elementor WordPress plugin before 1.7.1070 does not perform any authorization check before using the site owner's stored Mailchimp credential to add subscriber records to an audience chosen by the request, allowing unauthenticated attackers to inject arbitrary email addresses...
EUVD-2026-111707
The Royal Addons for Elementor WordPress plugin before 1.7.1070 does not sanitise and escape one of its map widget's size settings before concatenating it into an HTML attribute, allowing users with the Contributor role or above to inject JavaScript that runs in the browser of any user who views...
WordPress Royal Addons for Elementor plugin 1.7.1037-1.7.1069 - Contributor+ Stored XSS vulnerability
Contributor+ Stored XSS vulnerability discovered by Venkateswara Reddy Challa in WordPress Plugin Royal Elementor Addons versions 1.7.1037-1.7.1069...
WordPress Royal Addons for Elementor plugin 1.3.71-1.7.1069 - Unauthenticated Mailchimp Audience Injection vulnerability
Unauthenticated Mailchimp Audience Injection vulnerability discovered by Mohammed Abd Alrahman in WordPress Plugin Royal Elementor Addons versions 1.3.71-1.7.1069...
WordPress Royal Addons for Elementor plugin 1.3.81-1.7.1069 - Unauthenticated Non-Public Post Content Disclosure vulnerability
Unauthenticated Non-Public Post Content Disclosure vulnerability discovered by Maciek Komorowski in WordPress Plugin Royal Elementor Addons versions 1.3.81-1.7.1069...
EUVD-2026-111705
The Royal Addons for Elementor WordPress plugin before 1.7.1070 does not scope a contact form's email delivery configuration to the form's own document or owner, instead storing it in a site-global namespace keyed only on a non-secret, author-chosen identifier that is exposed in public page sourc...
WordPress Royal Addons for Elementor plugin 1.3.68-1.7.1069 - Author+ Form Submission Interception vulnerability
Author+ Form Submission Interception vulnerability discovered by Mohammed Abd Alrahman in WordPress Plugin Royal Elementor Addons versions 1.3.68-1.7.1069...
PT-2026-127824
The Royal Addons for Elementor WordPress plugin before 1.7.1070 does not sanitise and escape one of its map widget's size settings before concatenating it into an HTML attribute, allowing users with the Contributor role or above to inject JavaScript that runs in the browser of any user who views...
PT-2026-127825
The Royal Addons for Elementor WordPress plugin before 1.7.1070 does not verify that a requested post is publicly viewable before returning its content via an unauthenticated AJAX action, relying only on the published status and not on the post type's visibility, allowing unauthenticated users to...
PT-2026-127822
The Royal Addons for Elementor WordPress plugin before 1.7.1070 does not scope a contact form's email delivery configuration to the form's own document or owner, instead storing it in a site-global namespace keyed only on a non-secret, author-chosen identifier that is exposed in public page sourc...
PT-2026-127823
The Royal Addons for Elementor WordPress plugin before 1.7.1070 does not perform any authorization check before using the site owner's stored Mailchimp credential to add subscriber records to an audience chosen by the request, allowing unauthenticated attackers to inject arbitrary email addresses...
WordPress Royal Addons for Elementor code injection vulnerability
WordPress Royal Addons for Elementor versions 1.7.1068 and earlier contain a code injection vulnerability. This vulnerability stems from the use of externally controlled input selection classes or code unsafe reflection, potentially leading to code injection...
VulnCheck KEV: CVE-2025-13067
The Royal Addons for Elementor plugin for WordPress is vulnerable to arbitrary file upload in all versions up to, and including, 1.7.1049. This is due to insufficient file type validation detecting files named main.php, allowing a file with such a name to bypass sanitization. This makes it possib...
WordPress Royal Addons for Elementor plugin < 1.7.1067 - Unauthenticated Stored HTML Injection in Form Notification Emails vulnerability
Unauthenticated Stored HTML Injection in Form Notification Emails vulnerability discovered by Brian Willows in WordPress Plugin Royal Elementor Addons versions 1.7.1067...
CVE-2026-17585
The Royal Addons for Elementor – Addons and Templates Kit for Elementor plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.7.1066 via the 'wprkeyword' parameter. This makes it possible for unauthenticated attackers to extract arbitrary...