WP-CVE-2023-5360

WP-CVE-2023-5360 Royal Elementor Addons and Templates = 1.3.78 – Unauthenticated Arbitrary File Upload Python 2.7 Buy Coffee : Bitcoin $: 14nXhmRiQx5joCXFTdR8ydm3T8et7MFDXC How To Use? Install Python 2.7 Download Here python file.py Reff :...

CVE-2023-5360

CVE-2023-5360 CVE-2023-5360 Auto Shell Upload WordPress Royal Elementor 1.3.78 Shell Upload...

CVE-2023-5360

CVE-2023-5360 Elementor File Upload Exploit The Royal Elementor Addons and Templates WordPress plugin before 1.3.79 does not properly validate uploaded files, which could allow unauthenticated users to upload arbitrary files, such as PHP and achieve RCE. / / | / / / / / | | / / / / / | |/ /// /...

CVE-2023-5360

CVE-2023-5360 An Open-source EXPLOIT for The Royal Elementor Addons and Templates WordPress plugin before 1.3.79 does not properly validate uploaded files, which could allow unauthenticated users to upload arbitrary files, such as PHP and achieve RCE. Table of Contents Introduction Features Usage...

CVE-2023-5360-exploit-with-native-libraries

Royal Elementor Addons ≤ 1.3.78 – Unauthenticated Arbitrary File Upload RCE 📌 Overview This repository contains a modified proof-of-concept exploit for the WordPress plugin Royal Elementor Addons and Templates versions ≤ 1.3.78. The vulnerability allows unauthenticated arbitrary file upload , whi...

Worpress-CVE-2023-5360

CVE-2023-5360 CVE-2023-5360 Auto Shell Upload WordPress Royal Elementor 1.3.78 Shell Upload Visit https://phankz.com...

CVE-2026-106648

The Royal Elementor Addons WordPress plugin before 1.7.1070 does not validate submitted form field values before substituting them into the recipient addresses of its form notification emails, allowing unauthenticated attackers to replace the recipient list and relay attacker-composed email from...

CVE-2026-106648 Royal Elementor Addons < 1.7.1070 - Unauthenticated Arbitrary Email Recipient Injection via Form Field ID Shortcodes

The Royal Elementor Addons WordPress plugin before 1.7.1070 does not validate submitted form field values before substituting them into the recipient addresses of its form notification emails, allowing unauthenticated attackers to replace the recipient list and relay attacker-composed email from...

CVE-2026-106648 Royal Elementor Addons < 1.7.1070 - Unauthenticated Arbitrary Email Recipient Injection via Form Field ID Shortcodes

The Royal Elementor Addons WordPress plugin before 1.7.1070 does not validate submitted form field values before substituting them into the recipient addresses of its form notification emails, allowing unauthenticated attackers to replace the recipient list and relay attacker-composed email from...

EUVD-2026-111971

The Royal Elementor Addons WordPress plugin before 1.7.1070 does not validate submitted form field values before substituting them into the recipient addresses of its form notification emails, allowing unauthenticated attackers to replace the recipient list and relay attacker-composed email from...

WordPress Royal Elementor Addons plugin < 1.7.1070 - Unauthenticated Arbitrary Email Recipient Injection vulnerability

Unauthenticated Arbitrary Email Recipient Injection vulnerability discovered by Mohammed Abd Alrahman in WordPress Plugin Royal Elementor Addons versions 1.7.1070...

CVE-2026-106648

The Royal Elementor Addons WordPress plugin (versions prior to 1.7.1070 ) is vulnerable to Unauthenticated Arbitrary Email Recipient Injection . The root cause is the failure to validate submitted form field values before substituting them into the recipient addresses of form notification emails....

CVE-2026-107100 Royal Elementor Addons 1.3.81 - 1.7.1069 - Unauthenticated Non-Public Post Content Disclosure via wpr_get_page_content

The Royal Addons for Elementor WordPress plugin before 1.7.1070 does not verify that a requested post is publicly viewable before returning its content via an unauthenticated AJAX action, relying only on the published status and not on the post type's visibility, allowing unauthenticated users to...

CVE-2026-107098

The Royal Addons for Elementor WordPress plugin (versions 1.7.1037-1.7.1069 ) is vulnerable to Stored Cross-Site Scripting (XSS) . The root cause is a failure to sanitize and escape one of the map widget's size settings before it is concatenated into an HTML attribute. This allows users with Cont...

CVE-2026-107097 Royal Elementor Addons 1.3.71 - 1.7.1069 - Unauthenticated Mailchimp Audience Injection via mailchimp_subscribe

The Royal Addons for Elementor WordPress plugin before 1.7.1070 does not perform any authorization check before using the site owner's stored Mailchimp credential to add subscriber records to an audience chosen by the request, allowing unauthenticated attackers to inject arbitrary email addresses...

CVE-2026-107097 Royal Elementor Addons 1.3.71 - 1.7.1069 - Unauthenticated Mailchimp Audience Injection via mailchimp_subscribe

The Royal Addons for Elementor WordPress plugin before 1.7.1070 does not perform any authorization check before using the site owner's stored Mailchimp credential to add subscriber records to an audience chosen by the request, allowing unauthenticated attackers to inject arbitrary email addresses...

CVE-2026-107100 Royal Elementor Addons 1.3.81 - 1.7.1069 - Unauthenticated Non-Public Post Content Disclosure via wpr_get_page_content

The Royal Addons for Elementor WordPress plugin before 1.7.1070 does not verify that a requested post is publicly viewable before returning its content via an unauthenticated AJAX action, relying only on the published status and not on the post type's visibility, allowing unauthenticated users to...

CVE-2026-107097

The Royal Addons for Elementor WordPress plugin, in versions 1.3.71 through 1.7.1069 , is vulnerable to an unauthenticated Mailchimp audience injection (CVE-2026-107097). The root cause is a missing authorization check when the plugin utilizes the site owner's stored Mailchimp credentials. This a...

CVE-2026-107100

The Royal Addons for Elementor WordPress plugin (versions 1.3.81-1.7.1069 ) is vulnerable to unauthenticated content disclosure. The flaw exists because the plugin fails to verify if a requested post is publicly viewable before returning its content via an unauthenticated AJAX action . The applic...

CVE-2026-107098 Royal Elementor Addons 1.7.1037 - 1.7.1069 - Contributor+ Stored XSS via Google Maps Widget Height Setting

The Royal Addons for Elementor WordPress plugin before 1.7.1070 does not sanitise and escape one of its map widget's size settings before concatenating it into an HTML attribute, allowing users with the Contributor role or above to inject JavaScript that runs in the browser of any user who views...