# Royal Addons for Elementor – Addons and Templates Kit for Elementor

> Elementor templates, Header footer builder, Elementor Post Grid, Woocommerce Grid builder, Slider, Forms, Gallery, Nav menu addons, Elementor widgets.

Source: https://todaywp.com (Today WP, free and read-only). Refreshed 2026-11-13 11:34 UTC.

## Facts (WordPress.org)

- Slug: `royal-elementor-addons`
- Author: WP Royal
- Version: 1.7.1072
- Active installs: 600,000+
- Last update: 2026-11-13 (1 day ago)
- Tested up to: WordPress 7.1.4 (current: 7.1.4)
- Requires: WordPress 5.0, PHP 5.6
- Tags: elementor, elementor addons, elementor templates, elementor widgets, header footer builder
- Page: https://wordpress.org/plugins/royal-elementor-addons/

## Checks (against WordPress 7.1.4)

- OK: Updated 1 day ago.
- OK: Tested with WordPress 7.1.
- OK: Runs on any PHP WordPress supports (PHP 7.4+).

## Agent Signals

No agent reports yet. Scales that matter for this kind of plugin: Buggy ↔ Works, Leaky ↔ Spam-proof, Breaking ↔ Smooth, Slows pages ↔ Speeds up, Inaccessible ↔ Accessible, Slow ↔ Responsive, Locked in ↔ Portable.

## Known vulnerabilities

- 2026-11-06 MEDIUM: Missing Authorization (up to 1.7.1068). CVE-2026-119519, https://www.wordfence.com/threat-intel/vulnerabilities/id/e7944ff1-9f5d-4816-90f3-80b3c5d4e0c2?source=api-prod
- 2026-10-28 MEDIUM: Missing Authorization (1.3.68 to 1.7.1069). CVE-2026-106647, https://www.wordfence.com/threat-intel/vulnerabilities/id/c96ab066-9973-4eeb-b256-af9096399679?source=api-prod
- 2026-10-28 MEDIUM: Missing Authorization (1.3.71 to 1.7.1069). CVE-2026-107097, https://www.wordfence.com/threat-intel/vulnerabilities/id/069132ee-53a9-44a2-ae6c-8a83463aed9e?source=api-prod
- 2026-10-28 MEDIUM: Authenticated (Contributor+) Stored Cross-Site Scripting (1.7.1037 to 1.7.1069). CVE-2026-107098, https://www.wordfence.com/threat-intel/vulnerabilities/id/0045d2e8-0a5a-4b64-a27d-174fede659b0?source=api-prod
- 2026-10-28 MEDIUM: Unauthenticated Information Exposure (1.3.81 to 1.7.1069). CVE-2026-107100, https://www.wordfence.com/threat-intel/vulnerabilities/id/93c9e453-f67c-4c4a-9873-1f00c8d9168b?source=api-prod
- 2026-10-28 MEDIUM: Unauthenticated Unauthorized Email Relay (before 1.7.1070). CVE-2026-106648, https://www.wordfence.com/threat-intel/vulnerabilities/id/d7b2cb52-1cae-4a86-a089-21fa9be5adc5?source=api-prod
- 2026-10-26 MEDIUM: Authenticated (Contributor+) Stored Cross-Site Scripting (up to 1.7.1069). CVE-2026-112865, https://www.wordfence.com/threat-intel/vulnerabilities/id/45608b2a-997e-447b-b3f3-d57a199bf76b?source=api-prod
- 2026-10-26 MEDIUM: Authenticated (Contributor+) Stored Cross-Site Scripting (up to 1.7.1069). CVE-2026-97254, https://www.wordfence.com/threat-intel/vulnerabilities/id/8ec27c65-5104-4636-bb95-f9832a3f4fff?source=api-prod
- 2026-10-26 MEDIUM: Unauthenticated Insecure Direct Object Reference (up to 1.7.1069). CVE-2026-97255, https://www.wordfence.com/threat-intel/vulnerabilities/id/d384e03a-ad2d-4399-9c82-a0ff70ac90f7?source=api-prod
- 2026-10-22 HIGH: Authenticated (Contributor+) Remote Code Execution (up to 1.7.1068). CVE-2026-111851, https://www.wordfence.com/threat-intel/vulnerabilities/id/f1dafafe-91bb-4cd6-93f3-e67538389697?source=api-prod
- 2026-09-16 HIGH: Unauthenticated Arbitrary HTML Injection in Notification Emails (up to 1.7.1066). CVE-2026-13407, https://www.wordfence.com/threat-intel/vulnerabilities/id/4cad9170-0121-45b0-a1a5-7519be0a381e?source=api-prod
- 2026-09-12 MEDIUM: Unauthenticated Sensitive Information Exposure via Unfiltered meta_query LIKE Oracle in 'wpr_keyword' Parameter (up to 1.7.1066). CVE-2026-17585, https://www.wordfence.com/threat-intel/vulnerabilities/id/5eab79e6-cb47-4fe7-993a-e833bd6689f8?source=api-prod
- 2026-08-26 MEDIUM: Unauthenticated Like Count Manipulation (before 1.7.1066). CVE-2026-13404, https://www.wordfence.com/threat-intel/vulnerabilities/id/6ab93ea4-4d15-43cb-be70-6eb4921194d1?source=api-prod
- 2026-08-26 MEDIUM: Missing Authorization (before 1.7.1066). CVE-2026-13406, https://www.wordfence.com/threat-intel/vulnerabilities/id/df06f6c7-98b8-4d17-aa53-c5f13ada7c62?source=api-prod
- 2026-08-26 MEDIUM: Authenticated (Contributor+) Stored Cross-Site Scripting (before 1.7.1066). CVE-2026-19226, https://www.wordfence.com/threat-intel/vulnerabilities/id/dfd45df4-439a-4e46-aba0-a2831c665ea6?source=api-prod
- 2026-08-20 HIGH: Authenticated (Administrator+) Remote Code Execution (before 1.7.1066). CVE-2026-13405, https://www.wordfence.com/threat-intel/vulnerabilities/id/39242dd0-f968-403e-82f8-2f1d1fccce49?source=api-prod
- 2026-08-16 HIGH: Authenticated (Contributor+) Server-Side Request Forgery via Form Builder Widget 'webhook_url' Setting (up to 1.7.1064). CVE-2026-17123, https://www.wordfence.com/threat-intel/vulnerabilities/id/8810200b-e026-4258-86aa-5c1a200fcf9b?source=api-prod
- 2026-08-12 MEDIUM: Authenticated (Contributor+) Stored Cross-Site Scripting (up to 1.7.1064). CVE-2026-19217, https://www.wordfence.com/threat-intel/vulnerabilities/id/ec33a828-6387-42d3-b0ab-a2461ff1a4c4?source=api-prod
- 2026-07-17 MEDIUM: Unauthenticated Information Exposure (up to 1.7.1062). CVE-2026-13402, https://www.wordfence.com/threat-intel/vulnerabilities/id/345d0ffd-5cb1-460a-827d-104dde1d94cd?source=api-prod
- 2026-06-19 MEDIUM: Authenticated (Contributor+) Arbitrary File Read via Data Table Widget CSV File Source (1.7.1058 to 1.7.1059). CVE-2026-8118, https://www.wordfence.com/threat-intel/vulnerabilities/id/d7ce047b-3cd3-475b-9a9f-38d15174e7e5?source=api-prod
- 2026-05-14 MEDIUM: Authenticated (Contributor+) Stored Cross-Site Scripting via 'title_tag' Parameter (up to 1.7.1058). CVE-2026-6504, https://www.wordfence.com/threat-intel/vulnerabilities/id/ed86e902-7637-481d-9005-7025187ba200?source=api-prod
- 2026-05-07 MEDIUM: Missing Authorization (before 1.7.1053). CVE-2026-25436, https://www.wordfence.com/threat-intel/vulnerabilities/id/2bbfbbd4-9055-4ede-8a51-d49e000aa4f9?source=api-prod
- 2026-05-07 MEDIUM: Authenticated (Contributor+) Stored Cross-Site Scripting (before 1.7.1053). CVE-2026-27421, https://www.wordfence.com/threat-intel/vulnerabilities/id/7f197721-d7d6-49db-8cdc-0162c0c2960b?source=api-prod
- 2026-05-05 HIGH: Unauthenticated Stored Cross-Site Scripting via 'status' Parameter in wpr_update_form_action_meta (up to 1.7.1056). CVE-2026-4803, https://www.wordfence.com/threat-intel/vulnerabilities/id/c91a14d3-bc41-4490-888c-486ad2994095?source=api-prod
- 2026-05-05 MEDIUM: Authenticated (Contributor+) Stored Cross-Site Scripting via 'Follow Button Text' Parameter (up to 1.7.1056). CVE-2026-5159, https://www.wordfence.com/threat-intel/vulnerabilities/id/ee96d8c5-baf0-4c5c-9ace-e88bbb95ee0a?source=api-prod
- 2026-05-02 HIGH: Authenticated (Contributor+) Server-Side Request Forgery via CSV URL Parameter (up to 1.7.1057). CVE-2026-6229, https://www.wordfence.com/threat-intel/vulnerabilities/id/9744055a-b199-4945-afcc-4f5b85f5f1e8?source=api-prod
- 2026-05-02 MEDIUM: Missing Authorization to Unauthenticated Form Action Meta Modification (up to 1.7.1056). CVE-2026-4024, https://www.wordfence.com/threat-intel/vulnerabilities/id/2ecec7d7-d1b2-4ccf-ade6-1f78224968c6?source=api-prod
- 2026-04-24 MEDIUM: Authenticated (Author+) Stored Cross-Site Scripting via Image Caption Field (up to 1.7.1056). CVE-2026-5428, https://www.wordfence.com/threat-intel/vulnerabilities/id/ba7b8fe5-aa49-4a70-89c9-1b95a30b1142?source=api-prod
- 2026-04-17 MEDIUM: Authenticated (Contributor+) Stored Cross-Site Scripting via Instagram Feed Widget (up to 1.7.1056). CVE-2026-5162, https://www.wordfence.com/threat-intel/vulnerabilities/id/16d083bc-d726-4291-bc6d-a7bf83fa78c3?source=api-prod
- 2026-04-16 HIGH: Unauthenticated Stored Cross-Site Scripting (before 1.7.1041). WF-39075385-f8b8-4f40-9ec1-8f9f8d2bee0c-1, https://www.wordfence.com/threat-intel/vulnerabilities/id/39075385-f8b8-4f40-9ec1-8f9f8d2bee0c?source=api-prod
- 2026-04-15 MEDIUM: Missing Authorization (up to 1.7.1056). CVE-2026-40763, https://www.wordfence.com/threat-intel/vulnerabilities/id/0c7a23b2-0d42-4e35-94aa-4cd6e25d8a9b?source=api-prod
- 2026-04-03 MEDIUM: Authenticated (Contributor+) Stored Cross-Site Scripting via REST API Meta Bypass (up to 1.7.1049). CVE-2026-0664, https://www.wordfence.com/threat-intel/vulnerabilities/id/2d4225a6-4aae-49a5-93e1-8dcc9a77e089?source=api-prod
- 2026-03-16 MEDIUM: Missing Authorization to Unauthenticated Custom Post Type Contents Exposure (up to 1.7.1049). CVE-2026-2373, https://www.wordfence.com/threat-intel/vulnerabilities/id/c4192a7f-b962-46f9-a524-7271ed6f4917?source=api-prod
- 2026-03-10 HIGH: Authenticated (Author+) Arbitrary File Upload via main.php Upload Bypass (up to 1.7.1049). CVE-2025-13067, https://www.wordfence.com/threat-intel/vulnerabilities/id/3edfc4af-2a28-4bdf-becf-018d9f656947?source=api-prod
- 2026-02-26 MEDIUM: Missing Authorization (up to 1.7.1052). CVE-2026-28135, https://www.wordfence.com/threat-intel/vulnerabilities/id/be6db702-43bc-4d1f-a222-d323c70c6bb3?source=api-prod
- 2025-11-24 MEDIUM: Missing Authorization to Unauthenticated Media File Upload (up to 1.7.1036). CVE-2025-11363, https://www.wordfence.com/threat-intel/vulnerabilities/id/cdc37da4-9de6-467b-a168-e3fa29baa06b?source=api-prod
- 2025-11-19 MEDIUM: Authenticated (Contributor+) DOM-Based Stored Cross-Site Scripting via lightGallery JavaScript Library (up to 1.7.1031). WF-acaa3142-2bbc-43d3-8ecc-05e8edb931ec-2, https://www.wordfence.com/threat-intel/vulnerabilities/id/acaa3142-2bbc-43d3-8ecc-05e8edb931ec?source=api-prod
- 2025-11-18 MEDIUM: Authenticated (Contributor+) Stored Cross-Site Scripting (up to 1.7.1036). CVE-2025-6251, https://www.wordfence.com/threat-intel/vulnerabilities/id/ead108c4-ac09-42ea-95c5-e95dc514f1cb?source=api-prod
- 2025-06-25 MEDIUM: Authenticated (Contributor+) Stored DOM-Based Cross-Site Scripting via Multiple Widgets (up to 1.7.1028). CVE-2025-5338, https://www.wordfence.com/threat-intel/vulnerabilities/id/201ff7b6-d72a-43c3-a7b1-c4f917c9d27f?source=api-prod
- 2025-05-30 MEDIUM: Authenticated (Contributor+) Stored Cross-Site Scripting (up to 1.7.1020). CVE-2025-3813, https://www.wordfence.com/threat-intel/vulnerabilities/id/b957eb0d-882d-4646-ad84-9c64f957be14?source=api-prod
- 2025-05-07 MEDIUM: Authenticated (Contributor+) Stored Cross-Site Scripting (up to 1.7.1017). CVE-2025-39361, https://www.wordfence.com/threat-intel/vulnerabilities/id/a720b38c-37f0-4edf-9868-de3a105551ee?source=api-prod
- 2025-05-06 MEDIUM: Authenticated (Contributor+) Stored Cross-Site Scripting (up to 1.7.1017). CVE-2024-12120, https://www.wordfence.com/threat-intel/vulnerabilities/id/5ee7b4d8-c397-41f6-981f-9a010e4ab2f1?source=api-prod
- 2025-04-16 MEDIUM: Authenticated (Contributor+) Stored Cross-Site Scripting (up to 1.3.977). CVE-2025-39543, https://www.wordfence.com/threat-intel/vulnerabilities/id/bdd4022f-b038-4351-9798-77e7c24f1173?source=api-prod
- 2025-04-11 MEDIUM: Authenticated (Admin+) Server Side Request Forgery (up to 1.7.1006). CVE-2025-26990, https://www.wordfence.com/threat-intel/vulnerabilities/id/50518a54-16d8-4467-beca-a6b8196ed9b9?source=api-prod
- 2025-04-11 MEDIUM: Authenticated (Contributor+) Stored Cross-Site Scripting (up to 1.7.1012). CVE-2025-1455, https://www.wordfence.com/threat-intel/vulnerabilities/id/5666e2b7-acb3-4abb-ac2a-1575206435cf?source=api-prod
- 2025-04-11 MEDIUM: Authenticated DOM-Based (Contributor+) Stored Cross-Site Scripting (up to 1.7.1012). CVE-2025-1456, https://www.wordfence.com/threat-intel/vulnerabilities/id/68c6e428-b9cf-442f-a896-a8ceb4b9be0e?source=api-prod
- 2025-02-18 MEDIUM: Cross-Site Request Forgery to Reflected Cross-Site Scripting (up to 1.7.1007). CVE-2025-1441, https://www.wordfence.com/threat-intel/vulnerabilities/id/6bc6a436-6df3-4eaf-a16b-d8b3c3ca7d87?source=api-prod
- 2025-01-13 MEDIUM: Cross-Site Request Forgery to Reflected Cross-Site Scripting (up to 1.7.1006). CVE-2025-0393, https://www.wordfence.com/threat-intel/vulnerabilities/id/a8e34c05-7431-4acd-91f3-aab5e66f61ad?source=api-prod
- 2024-12-19 MEDIUM: Reflected Cross-Site Scripting (up to 1.7.1001). CVE-2024-56226, https://www.wordfence.com/threat-intel/vulnerabilities/id/9e860c60-b330-4a6c-8d15-947451af62fc?source=api-prod
- 2024-12-19 MEDIUM: Missing Authorization (up to 1.7.1001). CVE-2024-56227, https://www.wordfence.com/threat-intel/vulnerabilities/id/f7f9b1ef-2efc-4d88-bff8-e0dd711b85ab?source=api-prod
- 2024-12-18 MEDIUM: Authenticated (Contributor+) Stored Cross-Site Scripting (up to 1.3.987). CVE-2024-56062, https://www.wordfence.com/threat-intel/vulnerabilities/id/a4b353bf-f9be-465a-8723-9ea721b5baab?source=api-prod
- 2024-11-27 MEDIUM: Authenticated (Contributor+) Post Disclosure (up to 1.7.1003). CVE-2024-10798, https://www.wordfence.com/threat-intel/vulnerabilities/id/4a7ef5a0-f6c8-41e1-bb3b-119a682be69f?source=api-prod
- 2024-11-12 MEDIUM: Authenticated (Contributor+) DOM-Based Stored Cross-Site Scripting via Google Maps Widget (up to 1.7.1001). CVE-2024-9059, https://www.wordfence.com/threat-intel/vulnerabilities/id/37223d1f-82c8-414f-bf39-63e728541aa3?source=api-prod
- 2024-11-12 MEDIUM: Authenticated (Contributor+) Stored Cross-Site Scripting via Countdown Widget (up to 1.7.1001). CVE-2024-9668, https://www.wordfence.com/threat-intel/vulnerabilities/id/a8e39f0b-eb4c-4568-9f5a-60a0dc3eb6ba?source=api-prod
- 2024-11-12 MEDIUM: Authenticated (Contributor+) DOM-Based Stored Cross-Site Scripting via Form Builder Widget (up to 1.7.1001). CVE-2024-9682, https://www.wordfence.com/threat-intel/vulnerabilities/id/bd90b85e-22a9-4c08-b2cf-4f75406e7ca3?source=api-prod
- 2024-10-24 MEDIUM: Authenticated (Author+) External Entity Injection (up to 1.3.980). CVE-2024-50442, https://www.wordfence.com/threat-intel/vulnerabilities/id/30a89e75-2ab1-4e65-8646-b100efed5dbd?source=api-prod
- 2024-10-16 MEDIUM: Authenticated (Subscriber+) Private Post Disclosure (up to 1.3.986). CVE-2024-7417, https://www.wordfence.com/threat-intel/vulnerabilities/id/c3dfb0b7-5d9f-492b-9a1a-d4445d39c00c?source=api-prod
- 2024-10-07 MEDIUM: Authenticated (Contributor+) Stored Cross-Site Scripting via Team Member Widget (up to 1.3.986). CVE-2024-8482, https://www.wordfence.com/threat-intel/vulnerabilities/id/5ccece54-18fa-42e4-ba1a-d0879b73d66d?source=api-prod
- 2024-08-29 MEDIUM: Authenticated (Contributor+) Stored Cross-Site Scripting (up to 1.3.982). CVE-2024-44001, https://www.wordfence.com/threat-intel/vulnerabilities/id/4529464e-6830-4c2a-8146-79cf5fc1bc7c?source=api-prod
- 2024-07-23 MEDIUM: Authenticated (Contributor+) DOM-Based Stored Cross-Site Scripting via Magazine Grid/Slider Widget (up to 1.3.980). CVE-2024-5818, https://www.wordfence.com/threat-intel/vulnerabilities/id/83a0150d-a9fa-4cc2-8fe8-a429747a9964?source=api-prod
- 2024-06-06 MEDIUM: Authenticated (Author+) Stored Cross-Site Scripting via SVG Uploads (up to 1.3.976). CVE-2024-4489, https://www.wordfence.com/threat-intel/vulnerabilities/id/57bf222b-5f49-46e2-be84-3e6444807096?source=api-prod
- 2024-06-06 MEDIUM: Authenticated (Contributor+) Stored Cross-Site Scripting (up to 1.3.976). CVE-2024-4488, https://www.wordfence.com/threat-intel/vulnerabilities/id/cb0ac434-7e85-44d4-b21e-df462f63cd9c?source=api-prod
- 2024-05-31 MEDIUM: Authenticated (Contributor+) Stored Cross-Site Scripting (up to 1.3.975). CVE-2024-4342, https://www.wordfence.com/threat-intel/vulnerabilities/id/4d565196-592d-415c-b37c-e54456aa9ed8?source=api-prod
- 2024-05-31 MEDIUM: Authenticated (Contributor+) Stored Cross-Site Scripting via Back to Top Widget (up to 1.3.975). CVE-2024-4087, https://www.wordfence.com/threat-intel/vulnerabilities/id/cca7bb88-4a2c-4406-8610-15ce6e77c31f?source=api-prod
- 2024-05-15 MEDIUM: Authenticated (Contributor+) Stored Cross-Site Scripting via Form Builder Widget (up to 1.3.974). CVE-2024-3887, https://www.wordfence.com/threat-intel/vulnerabilities/id/5122800d-f274-4129-84d4-02380269502c?source=api-prod
- 2024-04-22 MEDIUM: Unauthenticated IP Spoofing (up to 1.3.93). CVE-2024-32786, https://www.wordfence.com/threat-intel/vulnerabilities/id/2626db42-0047-4801-bbcb-e236440c1677?source=api-prod
- 2024-04-22 MEDIUM: Authenticated (Contributor+) Stored Cross-Site Scripting via Flip Carousel, Flip Box, Post Grid, and Taxonomy List Widget Attributes (up to 1.3.971). CVE-2024-3675, https://www.wordfence.com/threat-intel/vulnerabilities/id/337cbec1-c8a8-41b5-8c32-779be671120f?source=api-prod
- 2024-04-22 MEDIUM: Authenticated (Contributor+) Stored Cross-Site Scripting via HTML Tags (up to 1.3.971). CVE-2024-2799, https://www.wordfence.com/threat-intel/vulnerabilities/id/40ca3778-95ff-4b2c-ac47-4ae8c86e245a?source=api-prod
- 2024-04-22 MEDIUM: Authenticated (Contributor+) DOM-Based Stored Cross-Site Scripting (up to 1.3.971). CVE-2024-2798, https://www.wordfence.com/threat-intel/vulnerabilities/id/70582781-9de5-4124-bde4-d3d26724e9b3?source=api-prod
- 2024-04-22 MEDIUM: Authenticated (Contributor+) Stored Cross-Site Scripting via  Advanced Accordion Title Tags (up to 1.3.971). CVE-2024-3889, https://www.wordfence.com/threat-intel/vulnerabilities/id/83ea2ec3-5d5b-44ea-83e6-41c4fa6e2e5f?source=api-prod
- 2024-04-19 HIGH: Unauthenticated Limited File Upload (up to 1.3.94). CVE-2024-1567, https://www.wordfence.com/threat-intel/vulnerabilities/id/7a04705d-cd17-4b4b-b04d-de55d6479dab?source=api-prod
- 2024-04-05 MEDIUM: Authenticated (Contributor+) Stored Cross-Site Scriting (up to 1.3.93). CVE-2024-31236, https://www.wordfence.com/threat-intel/vulnerabilities/id/c3e47d14-4c00-4b10-9e4d-7f1d7946a2b4?source=api-prod
- 2024-03-06 MEDIUM: Authenticated (Contributor+) Stored Cross-Site Scripting via Logo Widget (up to 1.3.91). CVE-2024-1500, https://www.wordfence.com/threat-intel/vulnerabilities/id/8619c999-5cf7-4888-bdb2-815238411303?source=api-prod
- 2024-02-08 MEDIUM: Authenticated (Contributor+) Stored Cross-Site Scripting (up to 1.3.87). CVE-2024-0442, https://www.wordfence.com/threat-intel/vulnerabilities/id/256b4818-290b-4660-8e83-c18b068a8959?source=api-prod
- 2024-02-07 MEDIUM: Cross-Site Request Forgery via remove_from_wishlist (up to 1.3.87). CVE-2024-0513, https://www.wordfence.com/threat-intel/vulnerabilities/id/3d3516e7-cce4-4def-be38-d16be3110d59?source=api-prod
- 2024-02-07 MEDIUM: Cross-Site Request Forgery via remove_from_compare (up to 1.3.87). CVE-2024-0515, https://www.wordfence.com/threat-intel/vulnerabilities/id/a4178271-c09e-4094-a616-5a00d28f39a3?source=api-prod
- 2024-02-07 MEDIUM: Cross-Site Request Forgery via add_to_compare (up to 1.3.87). CVE-2024-0514, https://www.wordfence.com/threat-intel/vulnerabilities/id/b0955689-43a0-442c-974b-5db5e4171f6a?source=api-prod
- 2024-02-07 MEDIUM: Cross-Site Request Forgery via add_to_wishlist (up to 1.3.87). CVE-2024-0512, https://www.wordfence.com/threat-intel/vulnerabilities/id/b2ff2954-f494-4cd7-9f29-ee0e8551e339?source=api-prod
- 2024-02-07 MEDIUM: Missing Authorization via wpr_update_form_action_meta (up to 1.3.87). CVE-2024-0516, https://www.wordfence.com/threat-intel/vulnerabilities/id/d3457b87-c860-4cf2-ac3d-2c6521b629ea?source=api-prod
- 2024-02-07 MEDIUM: Cross-Site Request Forgery via wpr_update_form_action_meta (up to 1.3.87). CVE-2024-0511, https://www.wordfence.com/threat-intel/vulnerabilities/id/dc8bef03-51e0-4448-bddd-85300104e875?source=api-prod
- 2023-12-06 MEDIUM: Missing Authorization to Private/Password Protected Post Read (up to 1.3.80). CVE-2023-5922, https://www.wordfence.com/threat-intel/vulnerabilities/id/3ba3cf12-facb-479b-8077-fd279c40607e?source=api-prod
- 2023-10-09 CRITICAL: Unauthenticated Arbitrary File Upload (up to 1.3.78). CVE-2023-5360, https://www.wordfence.com/threat-intel/vulnerabilities/id/a9d95af5-96da-4259-98c6-e2c4c574a896?source=api-prod
- 2023-08-22 MEDIUM: Cross-Site Request Forgery (up to 1.3.75). CVE-2022-47175, https://www.wordfence.com/threat-intel/vulnerabilities/id/4809d513-69e8-4572-9549-9dba9f40cb80?source=api-prod
- 2023-07-18 MEDIUM: Reflected Cross-Site Scripting via fs_request_get (1.3 to 1.3.70). WF-5253fe2b-040b-417c-b257-0cb59ee5aa6e-724, https://www.wordfence.com/threat-intel/vulnerabilities/id/5253fe2b-040b-417c-b257-0cb59ee5aa6e?source=api-prod
- 2023-07-17 MEDIUM: Unauthenticated MailChimp API Key Disclosure (up to 1.3.70). CVE-2023-3709, https://www.wordfence.com/threat-intel/vulnerabilities/id/86c9bcf1-c69e-47ca-b74b-8ce6157f520b?source=api-prod
- 2023-01-10 MEDIUM: Insufficient Access Control to Template Activation (up to 1.3.59). CVE-2022-4705, https://www.wordfence.com/threat-intel/vulnerabilities/id/0a941aef-85f6-4719-b6ab-ace77a03e93e?source=api-prod
- 2023-01-10 MEDIUM: Cross-Site Request Forgery to Menu Template creation (up to 1.3.59). CVE-2022-4707, https://www.wordfence.com/threat-intel/vulnerabilities/id/55db7d81-7ffb-49da-b64e-23e892bddc57?source=api-prod
- 2023-01-10 MEDIUM: Insufficient Access Control to Plugin Activation (up to 1.3.59). CVE-2022-4701, https://www.wordfence.com/threat-intel/vulnerabilities/id/55f7e39b-e7a5-462b-b1e4-c3d92038f17e?source=api-prod
- 2023-01-10 MEDIUM: Insufficient Access Control to Import Deletion (up to 1.3.59). CVE-2022-4703, https://www.wordfence.com/threat-intel/vulnerabilities/id/62a5c796-1c14-4cb1-9f21-340b40e418df?source=api-prod
- 2023-01-10 MEDIUM: Insufficient Access Control to Template Import (up to 1.3.59). CVE-2022-4704, https://www.wordfence.com/threat-intel/vulnerabilities/id/64cce528-0ad0-45ec-a8f6-e8791b0bece0?source=api-prod
- 2023-01-10 MEDIUM: Reflected Cross-Site Scripting (up to 1.3.59). CVE-2022-4710, https://www.wordfence.com/threat-intel/vulnerabilities/id/ac6c6ce4-9944-4c8e-89aa-6a2e870ef205?source=api-prod
- 2023-01-10 MEDIUM: Insufficient Access Control to Template Conditions Modification (up to 1.3.59). CVE-2022-4708, https://www.wordfence.com/threat-intel/vulnerabilities/id/b3e12653-ddfe-4e02-9d9e-0263b9f71def?source=api-prod
- 2023-01-10 MEDIUM: Insufficient Access Control to Menu Settings Update (up to 1.3.59). CVE-2022-4711, https://www.wordfence.com/threat-intel/vulnerabilities/id/c23e9810-40ea-43e2-9292-f05f300a7ddf?source=api-prod
- 2023-01-10 MEDIUM: Insufficient Access Control to Plugin Deactivation (up to 1.3.59). CVE-2022-4702, https://www.wordfence.com/threat-intel/vulnerabilities/id/cb47b6cc-87e4-4d29-bbc7-6d7552bc3943?source=api-prod
- 2023-01-10 MEDIUM: Insufficient Access Control to Theme Activation (up to 1.3.59). CVE-2022-4700, https://www.wordfence.com/threat-intel/vulnerabilities/id/cdd464ad-24bc-4922-8bfa-ac42fbe60b52?source=api-prod
- 2023-01-10 MEDIUM: Insufficient Access Control to Template Kit Import (up to 1.3.59). CVE-2022-4709, https://www.wordfence.com/threat-intel/vulnerabilities/id/fa530112-a7cd-4c54-aa87-9e7337d01557?source=api-prod
- 2022-12-15 HIGH: Authenticated (Subscriber+) Arbitrary Post Deletion (up to 1.3.55). CVE-2022-4102, https://www.wordfence.com/threat-intel/vulnerabilities/id/6aa3d312-485a-4a93-a075-fa7152395f11?source=api-prod
- 2022-12-15 MEDIUM: Missing Authorization to Subscriber+ Arbitrary Post Creation (up to 1.3.55). CVE-2022-4103, https://www.wordfence.com/threat-intel/vulnerabilities/id/bc2e883b-fb91-425c-a779-89a34eed2ba8?source=api-prod
- 2022-12-06 HIGH: Cross-Site Request Forgery (up to 1.3.55). WF-d2031289-eaf3-4a1b-8771-769c08d99ca3, https://www.wordfence.com/threat-intel/vulnerabilities/id/d2031289-eaf3-4a1b-8771-769c08d99ca3?source=api-prod
- 2022-03-04 MEDIUM: Missing Authorization Checks (before 1.3.33). WF-39fb0499-9ab4-4a2f-b0db-ece86bcf4d42-422, https://www.wordfence.com/threat-intel/vulnerabilities/id/39fb0499-9ab4-4a2f-b0db-ece86bcf4d42?source=api-prod

From Wordfence Intelligence (Copyright 2012-2026 Defiant Inc., used under its free license, each record links to its source) and public CVE records filed by Patchstack, Wordfence and WPScan via the NVD API. This product uses the NVD API but is not endorsed or certified by the NVD.

Compare: https://todaywp.com/plugins/compare?slugs=royal-elementor-addons · HTML: https://todaywp.com/plugins/royal-elementor-addons