CVE-2026-13406 Royal Elementor Addons < 1.7.1066 - Unauthenticated Taxonomy Term Disclosure

The Royal Addons for Elementor WordPress plugin before 1.7.1066 does not perform any capability or nonce check before returning taxonomy term data for an arbitrary, caller-supplied taxonomy, allowing unauthenticated users to disclose the names and IDs of terms belonging to non-public taxonomies...

WordPress Royal Addons for Elementor plugin < 1.7.1066 - Unauthenticated Like Count and IP Meta Modification vulnerability

Unauthenticated Like Count and IP Meta Modification vulnerability discovered by Shivamani Vastrala in WordPress Plugin Royal Elementor Addons versions 1.7.1066...

WordPress Royal Addons for Elementor plugin < 1.7.1066 - Unauthenticated Taxonomy Term Disclosure vulnerability

Unauthenticated Taxonomy Term Disclosure vulnerability discovered by Meher Sudhakar Abbireddi in WordPress Plugin Royal Elementor Addons versions 1.7.1066...

CVE-2023-5360-exploit-with-native-libraries

Royal Elementor Addons ≤ 1.3.78 – Caricamento Arbitrario di File Non Autenticato RCE 📌 Panoramica Questo repository contiene un exploit proof-of-concept modificato per il plugin WordPress Royal Elementor Addons and Templates versioni ≤ 1.3.78. La vulnerabilità permette il caricamento arbitrario d...

CVE-2026-13405

The Royal Addons for Elementor WordPress plugin before 1.7.1066 does not correctly sanitise custom widget markup before writing it to a file that is later executed, allowing users with the manageoptions capability and, on WordPress Multisite, non-super subsite administrators who do not otherwise...

EUVD-2026-63201

The Royal Addons for Elementor WordPress plugin before 1.7.1066 does not correctly sanitise custom widget markup before writing it to a file that is later executed, allowing users with the manageoptions capability and, on WordPress Multisite, non-super subsite administrators who do not otherwise...

CVE-2026-13405 Royal Elementor Addons < 1.7.1066 - Admin+ Remote Code Execution via Widget Builder

The Royal Addons for Elementor WordPress plugin before 1.7.1066 does not correctly sanitise custom widget markup before writing it to a file that is later executed, allowing users with the manageoptions capability and, on WordPress Multisite, non-super subsite administrators who do not otherwise...

CVE-2026-13405

Royal Elementor Addons before 1.7.1066 fails to sanitize custom widget markup before writing it to an executed file. An attacker with manage_options capability (or non-super Multisite subsite admin) can inject arbitrary PHP code, achieving remote code execution. CVSS 6.6 MEDIUM. No exploitation o...

CVE-2026-17123

The Royal Elementor Addons plugin for WordPress is vulnerable to Server-Side Request Forgery in versions up to, and including, 1.7.1064 via the Form Builder widget's 'webhookurl' setting. The widget's render method persists the attacker-controlled URL into the wprwebhookurlwidgetid option on ever...

CVE-2026-17123 Royal Addons for Elementor <= 1.7.1064 - Authenticated (Contributor+) Server-Side Request Forgery via Form Builder Widget 'webhook_url' Setting

The Royal Elementor Addons plugin for WordPress is vulnerable to Server-Side Request Forgery in versions up to, and including, 1.7.1064 via the Form Builder widget's 'webhookurl' setting. The widget's render method persists the attacker-controlled URL into the wprwebhookurlwidgetid option on ever...

CVE-2026-17123

The CVE describe a Server-Side Request Forgery in the Royal Elementor Addons WordPress plugin (versions ≤ 1.7.1064). The Form Builder widget’s webhook_url setting persists attacker-controlled URLs into wpr_webhook_url_{widget_id} on each render. The wpr_form_builder_webhook AJAX handler, usable b...

CVE-2026-17123

The Royal Elementor Addons plugin for WordPress is vulnerable to Server-Side Request Forgery in versions up to, and including, 1.7.1064 via the Form Builder widget's 'webhookurl' setting. The widget's render method persists the attacker-controlled URL into the wprwebhookurlwidgetid option on ever...

EUVD-2026-59863

The Royal Elementor Addons plugin for WordPress is vulnerable to Server-Side Request Forgery in versions up to, and including, 1.7.1064 via the Form Builder widget's 'webhookurl' setting. The widget's render method persists the attacker-controlled URL into the wprwebhookurlwidgetid option on ever...

PT-2026-73098

The Royal Elementor Addons plugin for WordPress is vulnerable to Server-Side Request Forgery in versions up to, and including, 1.7.1064 via the Form Builder widget's 'webhook url' setting. The widget's render method persists the attacker-controlled URL into the wpr webhook url widget id option on...

WordPress Royal Elementor Addons plugin < 1.7.1065 - Contributor+ Stored XSS via Icon Box Widget vulnerability

Contributor+ Stored XSS via Icon Box Widget vulnerability discovered by Dmitrii Ignatyev in WordPress Plugin Royal Elementor Addons versions 1.7.1065...

CVE-2026-19217

The Royal Addons for Elementor WordPress plugin before 1.7.1065 does not validate a widget setting used to build an HTML tag before outputting it, which could allow users with the Contributor role and above to perform Stored Cross-Site Scripting attacks...

CVE-2026-19217

The Royal Addons for Elementor WordPress plugin before 1.7.1065 does not validate a widget setting used to build an HTML tag before outputting it, which could allow users with the Contributor role and above to perform Stored Cross-Site Scripting attacks...

CVE-2026-19217 Royal Elementor Addons < 1.7.1065 - Contributor+ Stored XSS via Icon Box Widget

The Royal Addons for Elementor WordPress plugin before 1.7.1065 does not validate a widget setting used to build an HTML tag before outputting it, which could allow users with the Contributor role and above to perform Stored Cross-Site Scripting attacks...

CVE-2026-19217

CVE-2026-19217 affects the Royal Addons for Elementor WordPress plugin (before version 1.7.1065). The vulnerability arises from improper validation of a widget setting used to construct an HTML tag, enabling Stored Cross-Site Scripting (XSS) by users with the Contributor role or higher. Impact is...

EUVD-2026-57108

The Royal Addons for Elementor WordPress plugin before 1.7.1065 does not validate a widget setting used to build an HTML tag before outputting it, which could allow users with the Contributor role and above to perform Stored Cross-Site Scripting attacks...