CVE-2023-5360

CVE-2023-5360 CVE-2023-5360 Subida Automática de Shell en WordPress Royal Elementor 1.3.78 Subida de Shell...

CVE-2023-5360

CVE-2023-5360 Exploit de Subida de Archivos en Elementor El plugin de WordPress Royal Elementor Addons and Templates anterior a la versión 1.3.79 no valida correctamente los archivos subidos, lo que podría permitir a usuarios no autenticados subir archivos arbitrarios, como PHP, y lograr RCE...

WP-CVE-2023-5360

WP-CVE-2023-5360 Royal Elementor Addons and Templates = 1.3.78 – Carga Arbitraria de Archivos sin Autenticación Python 2.7 Comprar Café : Bitcoin $: 14nXhmRiQx5joCXFTdR8ydm3T8et7MFDXC ¿Cómo Usar? Instalar Python 2.7 Descargar Aquí python file.py Ref :...

WordPress Royal Elementor Addons Plugin <= 1.3.78 - Arbitrary File Upload

Arbitrary File Upload vulnerability in WordPress Royal Elementor Addons Plugin. This could allow a malicious actor to upload any type of file to your website. This can include backdoors which are then executed to gain further access to your website. This vulnerability has been fixed in version...

CVE-2023-5360-exploit-with-native-libraries

Royal Elementor Addons ≤ 1.3.78 – Carga Arbitraria de Archivos No Autenticada RCE 📌 Resumen Este repositorio contiene un exploit de prueba de concepto modificado para el plugin de WordPress Royal Elementor Addons and Templates versiones ≤ 1.3.78. La vulnerabilidad permite la carga arbitraria de...

CVE-2023-5360

CVE-2023-5360 Un EXPLOIT open-source per Il plugin WordPress The Royal Elementor Addons and Templates precedente alla versione 1.3.79 non valida correttamente i file caricati, il che potrebbe consentire a utenti non autenticati di caricare file arbitrari, come PHP, e ottenere RCE. Indice...

Worpress-CVE-2023-5360

CVE-2023-5360 CVE-2023-5360 Upload Automático de Shell WordPress Royal Elementor 1.3.78 Upload de Shell Visite https://phankz.com...

CVE-2026-19226

Royal Addons for Elementor (WordPress plugin) versions before 1.7.1066 fail to validate certain Image Accordion Widget effect settings before outputting them inside an HTML attribute , enabling Stored Cross-Site Scripting (XSS) by authenticated users with the Contributor role or higher. The vulne...

CVE-2026-19226 Royal Elementor Addons < 1.7.1066 - Contributor+ Stored XSS via Image Accordion Widget Effect Settings

The Royal Addons for Elementor WordPress plugin before 1.7.1066 does not validate some widget settings before outputting them inside an HTML attribute, which could allow users with the Contributor role and above to perform Stored Cross-Site Scripting attacks...

CVE-2026-13406

CVE-2026-13406 affects the Royal Addons for Elementor WordPress plugin in versions before 1.7.1066 . The root cause is the absence of any capability or nonce check before the plugin returns taxonomy term data for a caller-supplied taxonomy. This allows unauthenticated users to disclose the names ...

CVE-2026-13404 Royal Elementor Addons < 1.7.1066 - Unauthenticated Like Count and IP Meta Modification via wpr_likes_init

The Royal Addons for Elementor WordPress plugin before 1.7.1066 does not perform any capability or ownership check relying only on a publicly-scrapeable nonce before writing like-count and visitor-tracking post meta keyed on an arbitrary post ID, allowing unauthenticated users to modify that...

CVE-2026-13404

CVE-2026-13404 affects the Royal Addons for Elementor WordPress plugin in versions prior to 1.7.1066 . The vulnerable function wpr_likes_init does not perform any capability or ownership check, relying solely on a publicly-scrapeable nonce before writing like-count and visitor-tracking post meta ...

CVE-2026-13406 Royal Elementor Addons < 1.7.1066 - Unauthenticated Taxonomy Term Disclosure

The Royal Addons for Elementor WordPress plugin before 1.7.1066 does not perform any capability or nonce check before returning taxonomy term data for an arbitrary, caller-supplied taxonomy, allowing unauthenticated users to disclose the names and IDs of terms belonging to non-public taxonomies...

CVE-2026-13405 Royal Elementor Addons < 1.7.1066 - Admin+ Remote Code Execution via Widget Builder

The Royal Addons for Elementor WordPress plugin before 1.7.1066 does not correctly sanitise custom widget markup before writing it to a file that is later executed, allowing users with the manageoptions capability and, on WordPress Multisite, non-super subsite administrators who do not otherwise...

CVE-2026-13405

Royal Elementor Addons before 1.7.1066 fails to sanitize custom widget markup before writing it to an executed file. An attacker with manage_options capability (or non-super Multisite subsite admin) can inject arbitrary PHP code, achieving remote code execution. CVSS 6.6 MEDIUM. No exploitation o...

CVE-2026-17123

The Royal Elementor Addons plugin for WordPress is vulnerable to Server-Side Request Forgery in versions up to, and including, 1.7.1064 via the Form Builder widget's 'webhookurl' setting. The widget's render method persists the attacker-controlled URL into the wprwebhookurlwidgetid option on ever...

CVE-2026-17123

The CVE describe a Server-Side Request Forgery in the Royal Elementor Addons WordPress plugin (versions ≤ 1.7.1064). The Form Builder widget’s webhook_url setting persists attacker-controlled URLs into wpr_webhook_url_{widget_id} on each render. The wpr_form_builder_webhook AJAX handler, usable b...

CVE-2026-17123 Royal Addons for Elementor <= 1.7.1064 - Authenticated (Contributor+) Server-Side Request Forgery via Form Builder Widget 'webhook_url' Setting

The Royal Elementor Addons plugin for WordPress is vulnerable to Server-Side Request Forgery in versions up to, and including, 1.7.1064 via the Form Builder widget's 'webhookurl' setting. The widget's render method persists the attacker-controlled URL into the wprwebhookurlwidgetid option on ever...

CVE-2026-17123

The Royal Elementor Addons plugin for WordPress is vulnerable to Server-Side Request Forgery in versions up to, and including, 1.7.1064 via the Form Builder widget's 'webhookurl' setting. The widget's render method persists the attacker-controlled URL into the wprwebhookurlwidgetid option on ever...

EUVD-2026-59863

The Royal Elementor Addons plugin for WordPress is vulnerable to Server-Side Request Forgery in versions up to, and including, 1.7.1064 via the Form Builder widget's 'webhookurl' setting. The widget's render method persists the attacker-controlled URL into the wprwebhookurlwidgetid option on ever...