WordPress plugin · royal-elementor-addons
Is Royal Addons for Elementor safe?
Safe on 1.7.1070 or newer.
The current version, 1.7.1070, is past every affected range on record (94 of 94 records list one). Keep it updated and you’re clear of them.
- Flaws on record
- 94
- High or critical
- 10
- Exploited
- none
- Current version
- 1.7.1070
- Last updated
- Oct 23, 2026
- Active installs
- 600,000+
Every recorded flaw
- Oct 28, 2026Royal Elementor Addons: Does not validate submitted form field values before substituting them into the recipient addresses of its form notification emailsCVE-2026-106648 · fixed in 1.7.1070 · reported by WPScanMedium 5.3
- Oct 28, 2026Royal Addons for Elementor: Does not verify that a requested post is publicly viewable before returning its content via an unauthenticated AJAX actionCVE-2026-107100 · fixed in 1.7.1070 · reported by WPScanMedium 5.3
- Oct 28, 2026Royal Addons for Elementor: Does not sanitise and escape one of its map widget's size settings before concatenating it into an HTML attributeCVE-2026-107098 · fixed in 1.7.1070 · reported by WPScanMedium 6.8
- Oct 28, 2026Royal Addons for Elementor: Does not perform any authorization check before using the site owner's stored Mailchimp credential to add subscriber records to an audience chosen by the requestCVE-2026-107097 · fixed in 1.7.1070 · reported by WPScanMedium 5.3
- Oct 28, 2026Royal Addons for Elementor: Does not scope a contact form's email delivery configuration to the form's own document or ownerCVE-2026-106647 · fixed in 1.7.1070 · reported by WPScanLow 3.8
- Oct 26, 2026Royal Elementor Addons: Authorization Bypass Through User-Controlled KeyCVE-2026-97255 · affects up to 1.7.1069 · reported by PatchstackMedium 5.3
- Oct 26, 2026Royal Elementor Addons: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-97254 · affects up to 1.7.1069 · reported by PatchstackMedium 6.5
- Oct 26, 2026Royal Elementor Addons: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-112865 · affects up to 1.7.1069 · reported by PatchstackMedium 6.5
- Oct 22, 2026Royal Elementor Addons: Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection')CVE-2026-111851 · affects up to 1.7.1068 · reported by PatchstackHigh 7.6
- Sep 16, 2026Royal Elementor Addons: Does not properly sanitize and escape values submitted through its form widget before including them in the body of administrator notification emailsCVE-2026-13407 · fixed in 1.7.1067 · reported by WPScanMedium 5.4
- Sep 12, 2026Royal Addons for Elementor – Addons and Templates Kit for Elementor: Sensitive Information ExposureCVE-2026-17585 · affects up to 1.7.1066 · reported by WordfenceMedium 5.3
- Aug 26, 2026Royal Addons for Elementor: Does not validate some widget settings before outputting them inside an HTML attributeCVE-2026-19226 · fixed in 1.7.1066 · reported by WPScanMedium 6.8
- Aug 26, 2026Royal Addons for Elementor: Does not perform any capability or nonce check before returning taxonomy term data for an arbitraryCVE-2026-13406 · fixed in 1.7.1066 · reported by WPScanMedium 5.3
- Aug 26, 2026Royal Addons for Elementor: Does not perform any capability or ownership check (relying only on a publicly-scrapeable nonce) before writing like-count and visitor-tracking post meta keyed on an arbitrary post IDCVE-2026-13404 · fixed in 1.7.1066 · reported by WPScanMedium 5.3
- Aug 20, 2026Royal Addons for Elementor: Does not correctly sanitise custom widget markup before writing it to a file that is later executedCVE-2026-13405 · fixed in 1.7.1066 · reported by WPScanMedium 6.6
- Aug 16, 2026Royal Elementor Addons: Server-Side Request ForgeryCVE-2026-17123 · affects up to 1.7.1064 · reported by WordfenceHigh 8.8
- Aug 12, 2026Royal Addons for Elementor: Does not validate a widget setting used to build an HTML tag before outputting itCVE-2026-19217 · fixed in 1.7.1065 · reported by WPScanMedium 5.4
- Jul 17, 2026Royal Addons for Elementor: Does not check the post status of menu items or the templates they reference in one of its REST endpointsCVE-2026-13402 · fixed in 1.7.1063 · reported by WPScanMedium 5.3
- Jun 19, 2026Royal Addons for Elementor – Addons and Templates Kit for Elementor: Arbitrary File ReadCVE-2026-8118 · affects up to 1.7.1059 · reported by WordfenceMedium 6.5
- May 14, 2026Royal Elementor Addons and Templates: Stored Cross-Site ScriptingCVE-2026-6504 · affects up to 1.7.1058 · reported by WordfenceMedium 6.4
- May 7, 2026Royal Elementor Addons: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-27421 · fixed in 1.7.1053 · reported by PatchstackMedium 6.5
- May 7, 2026Royal Elementor Addons: Missing AuthorizationCVE-2026-25436 · fixed in 1.7.1053 · reported by PatchstackMedium 5.3
- May 5, 2026Royal Addons for Elementor: Stored Cross-Site ScriptingCVE-2026-5159 · affects up to 1.7.1056 · reported by WordfenceMedium 6.4
- May 5, 2026Royal Elementor Addons: Stored Cross-Site ScriptingCVE-2026-4803 · affects up to 1.7.1056 · reported by WordfenceHigh 7.2
- May 2, 2026Royal Addons for Elementor: Unauthorized modification of dataCVE-2026-4024 · affects up to 1.7.1056 · reported by WordfenceMedium 5.3
- May 2, 2026Royal Elementor Addons: Server-Side Request ForgeryCVE-2026-6229 · affects up to 1.7.1057 · reported by WordfenceHigh 7.2
- Apr 24, 2026Royal Elementor Addons: Stored Cross-Site ScriptingCVE-2026-5428 · affects up to 1.7.1056 · reported by WordfenceMedium 6.4
- Apr 16, 2026Royal Addons for Elementor: Stored Cross-Site ScriptingCVE-2026-5162 · affects up to 1.7.1056 · reported by WordfenceMedium 6.4
- Apr 15, 2026Royal Elementor Addons: Missing AuthorizationCVE-2026-40763 · affects up to 1.7.1056 · reported by PatchstackMedium 5.3
- Apr 4, 2026Royal Addons for Elementor: Stored Cross-Site ScriptingCVE-2026-0664 · affects up to 1.7.1049 · reported by WordfenceMedium 6.4
- Mar 17, 2026Royal Addons for Elementor – Addons and Templates Kit for Elementor: Information ExposureCVE-2026-2373 · affects up to 1.7.1049 · reported by WordfenceMedium 5.3
- Mar 11, 2026Royal Addons for Elementor: Arbitrary file uploadCVE-2025-13067 · affects up to 1.7.1049 · reported by WordfenceHigh 8.8
- Mar 5, 2026Royal Elementor Addons: Inclusion of Functionality from Untrusted Control SphereCVE-2026-28135 · affects up to 1.7.1052 · reported by PatchstackHigh 8.2
- Dec 15, 2025Royal Addons for Elementor: Does not have proper authorisationCVE-2025-11363 · fixed in 1.7.1037 · reported by WPScanMedium 5.3
- Nov 18, 2025Royal Elementor Addons and Templates: Stored Cross-Site ScriptingCVE-2025-6251 · affects up to 1.7.1036 · reported by WordfenceMedium 6.4
- Jun 26, 2025Royal Elementor Addons: Stored Cross-Site ScriptingCVE-2025-5338 · affects up to 1.7.1028 · reported by WordfenceMedium 6.4
- May 31, 2025Royal Elementor Addons and Templates: Stored Cross-Site ScriptingCVE-2025-3813 · affects up to 1.7.1020 · reported by WordfenceMedium 6.4
- May 7, 2025Royal Elementor Addons: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-39361 · affects up to 1.7.1017 · reported by PatchstackMedium 6.5
- May 7, 2025Royal Elementor Addons and Templates: Stored Cross-Site ScriptingCVE-2024-12120 · affects up to 1.7.1017 · reported by WordfenceMedium 5.4
- Apr 16, 2025Royal Elementor Addons: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-39543 · affects up to 1.3.977 · reported by PatchstackMedium 6.5
- Apr 15, 2025Royal Elementor Addons: Server-Side Request Forgery (SSRF)CVE-2025-26990 · affects up to 1.7.1006 · reported by PatchstackMedium 4.4
- Apr 12, 2025Royal Elementor Addons and Templates: Stored Cross-Site ScriptingCVE-2025-1456 · affects up to 1.7.1012 · reported by WordfenceMedium 6.4
- Apr 12, 2025Royal Elementor Addons and Templates: Stored Cross-Site ScriptingCVE-2025-1455 · affects up to 1.7.1012 · reported by WordfenceMedium 6.4
- Feb 19, 2025Royal Elementor Addons and Templates: Cross-Site Request ForgeryCVE-2025-1441 · affects up to 1.7.1007 · reported by WordfenceMedium 6.1
- Jan 14, 2025Royal Elementor Addons and Templates: Cross-Site Request ForgeryCVE-2025-0393 · affects up to 1.7.1006 · reported by WordfenceMedium 6.1
- Dec 31, 2024Royal Elementor Addons: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-56062 · affects up to 1.3.987 · reported by PatchstackMedium 6.5
- Dec 31, 2024Royal Elementor Addons: Missing AuthorizationCVE-2024-56227 · affects up to 1.7.1001 · reported by PatchstackMedium 4.3
- Dec 31, 2024Royal Elementor Addons: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-56226 · affects up to 1.7.1001 · reported by PatchstackHigh 7.1
- Nov 28, 2024Royal Elementor Addons and Templates: Information ExposureCVE-2024-10798 · affects up to 1.7.1003 · reported by WordfenceMedium 4.3
- Nov 13, 2024Royal Elementor Addons and Templates: Stored Cross-Site ScriptingCVE-2024-9682 · affects up to 1.7.1001 · reported by WordfenceMedium 6.4
- Nov 13, 2024Royal Elementor Addons and Templates: Stored Cross-Site ScriptingCVE-2024-9668 · affects up to 1.7.1001 · reported by WordfenceMedium 6.4
- Nov 13, 2024Royal Elementor Addons and Templates: Stored Cross-Site ScriptingCVE-2024-9059 · affects up to 1.7.1001 · reported by WordfenceMedium 6.4
- Oct 28, 2024Royal Elementor Addons: Improper Restriction of XML External Entity ReferenceCVE-2024-50442 · affects up to 1.3.980 · reported by PatchstackMedium 6.5
- Oct 17, 2024Royal Elementor Addons and Templates: Information ExposureCVE-2024-7417 · affects up to 1.3.986 · reported by WordfenceMedium 4.3
- Oct 8, 2024Royal Elementor Addons and Templates: Stored Cross-Site ScriptingCVE-2024-8482 · affects up to 1.3.982 · reported by WordfenceMedium 6.4
- Sep 17, 2024Royal Elementor Addons: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-44001 · affects up to 1.3.982 · reported by PatchstackMedium 6.5
- Jul 24, 2024Royal Elementor Addons and Templates: Stored DOM-based Cross-Site ScriptingCVE-2024-5818 · affects up to 1.3.980 · reported by WordfenceMedium 6.4
- Jun 7, 2024Royal Elementor Addons and Templates: Stored Cross-Site ScriptingCVE-2024-4489 · affects up to 1.3.976 · reported by WordfenceMedium 6.4
- Jun 7, 2024Royal Elementor Addons and Templates: Stored Cross-Site ScriptingCVE-2024-4488 · affects up to 1.3.976 · reported by WordfenceMedium 6.4
- Jun 1, 2024Royal Elementor Addons and Templates: Stored Cross-Site ScriptingCVE-2024-4342 · affects up to 1.3.975 · reported by WordfenceMedium 6.4
- Jun 1, 2024Royal Elementor Addons and Templates: Stored Cross-Site ScriptingCVE-2024-4087 · affects up to 1.3.975 · reported by WordfenceMedium 6.4
- May 17, 2024Royal Elementor Addons: Authentication Bypass by SpoofingCVE-2024-32786 · affects up to 1.3.93 · reported by PatchstackMedium 5.3
- May 16, 2024Royal Elementor Addons and Templates: Stored Cross-Site ScriptingCVE-2024-3887 · affects up to 1.3.974 · reported by WordfenceMedium 5.4
- May 2, 2024Royal Elementor Addons and Templates: Stored Cross-Site ScriptingCVE-2024-3675 · affects up to 1.3.971 · reported by WordfenceMedium 6.4
- May 2, 2024Royal Elementor Addons and Templates: Limited file uploadsCVE-2024-1567 · affects up to 1.3.94 · reported by Wordfence1.1% oddsHigh 8.2
- Apr 23, 2024Royal Elementor Addons and Templates: Stored Cross-Site ScriptingCVE-2024-3889 · affects up to 1.3.971 · reported by WordfenceMedium 6.4
- Apr 23, 2024Royal Elementor Addons and Templates: Stored Cross-Site ScriptingCVE-2024-2799 · affects up to 1.3.96 · reported by WordfenceMedium 6.4
- Apr 23, 2024Royal Elementor Addons and Templates: Stored Cross-Site ScriptingCVE-2024-2798 · affects up to 1.3.971 · reported by WordfenceMedium 6.4
- Apr 7, 2024Royal Elementor Addons: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-31236 · affects up to 1.3.93 · reported by PatchstackMedium 6.5
- Mar 7, 2024Royal Elementor Addons and Templates: Stored Cross-Site ScriptingCVE-2024-1500 · affects up to 1.3.91 · reported by WordfenceMedium 5.4
- Feb 28, 2024Royal Elementor Addons and Templates: Unauthorized post metadata updateCVE-2024-0516 · affects up to 1.3.87 · reported by WordfenceMedium 5.3
- Feb 28, 2024Royal Elementor Addons and Templates: Cross-Site Request ForgeryCVE-2024-0515 · affects up to 1.3.87 · reported by WordfenceMedium 4.3
- Feb 28, 2024Royal Elementor Addons and Templates: Cross-Site Request ForgeryCVE-2024-0514 · affects up to 1.3.87 · reported by WordfenceMedium 4.3
- Feb 28, 2024Royal Elementor Addons and Templates: Cross-Site Request ForgeryCVE-2024-0513 · affects up to 1.3.87 · reported by WordfenceMedium 4.3
- Feb 28, 2024Royal Elementor Addons and Templates: Cross-Site Request ForgeryCVE-2024-0512 · affects up to 1.3.87 · reported by WordfenceMedium 4.3
- Feb 28, 2024Royal Elementor Addons and Templates: Stored Cross-Site ScriptingCVE-2024-0442 · affects up to 1.3.87 · reported by WordfenceMedium 6.4
- Feb 8, 2024Royal Elementor Addons and Templates: Cross-Site Request ForgeryCVE-2024-0511 · affects up to 1.3.87 · reported by WordfenceMedium 4.3
- Jan 16, 2024Royal Elementor Addons and Templates: Does not ensure that users accessing posts via an AJAX action (and REST endpointCVE-2023-5922 · fixed in 1.3.81 · reported by WPScanHigh 7.5
- Oct 31, 2023Royal Elementor Addons and Templates: Does not properly validate uploaded filesCVE-2023-5360 · fixed in 1.3.79 · reported by WPScan86% oddsCritical 9.8
- Oct 6, 2023Cross-Site Request Forgery (CSRF) vulnerability in P Royal Royal Elementor Addons and Templates plugin <= 1.3.75 versions.CVE-2022-47175 · affects up to 1.3.75 · reported by PatchstackMedium 4.3
- Jul 17, 2023Royal Elementor Addons: Unauthenticated API key disclosureCVE-2023-3709 · affects up to 1.3.70 · reported by WordfenceMedium 5.3
- Jan 10, 2023Royal Elementor Addons: Insufficient access control in the 'wpr_save_mega_menu_settings' AJAX actionCVE-2022-4711 · affects up to 1.3.59 · reported by WordfenceMedium 4.3
- Jan 10, 2023Royal Elementor Addons: Reflected Cross-Site ScriptingCVE-2022-4710 · affects up to 1.3.59 · reported by WordfenceMedium 6.1
- Jan 10, 2023Royal Elementor Addons: Insufficient access control in the 'wpr_import_library_template' AJAX actionCVE-2022-4709 · affects up to 1.3.59 · reported by WordfenceMedium 4.3
- Jan 10, 2023Royal Elementor Addons: Insufficient access control in the 'wpr_save_template_conditions' AJAX actionCVE-2022-4708 · affects up to 1.3.59 · reported by WordfenceMedium 4.3
- Jan 10, 2023Royal Elementor Addons: Cross-Site Request ForgeryCVE-2022-4707 · affects up to 1.3.59 · reported by WordfenceMedium 4.3
- Jan 10, 2023Royal Elementor Addons: Insufficient access control in the 'wpr_final_settings_setup' AJAX actionCVE-2022-4705 · affects up to 1.3.59 · reported by WordfenceMedium 4.3
- Jan 10, 2023Royal Elementor Addons: Insufficient access control in the 'wpr_import_templates_kit' AJAX actionCVE-2022-4704 · affects up to 1.3.59 · reported by WordfenceMedium 5.4
- Jan 10, 2023Royal Elementor Addons: Insufficient access control in the 'wpr_reset_previous_import' AJAX actionCVE-2022-4703 · affects up to 1.3.59 · reported by WordfenceMedium 4.3
- Jan 10, 2023Royal Elementor Addons: Insufficient access control in the 'wpr_fix_royal_compatibility' AJAX actionCVE-2022-4702 · affects up to 1.3.59 · reported by WordfenceMedium 5.4
- Jan 10, 2023Royal Elementor Addons: Insufficient access control in the 'wpr_activate_required_plugins' AJAX actionCVE-2022-4701 · affects up to 1.3.59 · reported by WordfenceMedium 4.3
- Jan 10, 2023Royal Elementor Addons: Insufficient access control in the 'wpr_activate_required_theme' AJAX actionCVE-2022-4700 · affects up to 1.3.59 · reported by WordfenceMedium 5.4
- Jan 9, 2023Royal Elementor Addons: Does not have authorisation and CSRF checksCVE-2022-4103 · fixed in 1.3.56 · reported by WPScanMedium 4.3
- Jan 9, 2023Royal Elementor Addons: Does not have authorization and CSRF checksCVE-2022-4102 · fixed in 1.3.56 · reported by WPScanLow 3.1
Records come from the National Vulnerability Database, published by the researchers who found each flaw (Wordfence, Patchstack, WPScan and others); exploited status from CISA; exploit odds from FIRST’s EPSS; current version, installs and closures from wordpress.org, checked daily. Want every plugin on your site checked at once? Run the free website check.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Get in touch
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
01The person who'll do the work writes back
02A short call, then a written plan with the price
03Nothing starts until you say yes
04Hacked or down right now? Call, and we pick up the same day
Not ready to talk yet? Run the free website check and see what Google sees.