VulnCrest
Search
Create account
Report an incident
Radar sectionsPlugins & themes
Check my site

WordPress plugin

Royal Addons for Elementor – Addons and Templates Kit for Elementor security & vulnerabilities

royal-elementor-addons— active installsLast vulnerability Nov 6, 2026

Unpatched vulnerability in the latest version

At least one vulnerability affects the latest version and no fix has been released. Deactivate the plugin or restrict access to the affected feature until the vendor ships a patch.

Watch plugin
101Known vulnerabilities
  • Critical1
  • High12
  • Medium88
  • Low0
Vulnerabilities per year
2022: 5 vulnerabilities5222023: 16 vulnerabilities16232024: 32 vulnerabilities32242025: 13 vulnerabilities13252026: 35 vulnerabilities3526

All Royal Addons for Elementor – Addons and Templates Kit for Elementor vulnerabilities

Royal Addons for Elementor – Addons and Templates Kit for Elementor vulnerabilities
SeverityVulnerabilityCVEPublished
Medium4.3Missing Authorization
≤1.7.1068Update to 1.7.1069
CVE-2026-119519
Medium5.31.7.1069 - Missing Authorization
1.3.71 – 1.7.1069Update to 1.7.1070
CVE-2026-107097
Medium6.41.7.1069 - Authenticated (Contributor+) Stored Cross-Site Scripting
1.7.1037 – 1.7.1069Update to 1.7.1070
CVE-2026-107098
Medium5.31.7.1069 - Unauthenticated Information Exposure
1.3.81 – 1.7.1069Update to 1.7.1070
CVE-2026-107100
Medium4.31.7.1069 - Missing Authorization
1.3.68 – 1.7.1069Update to 1.7.1070
CVE-2026-106647
Medium5.3Unauthenticated Insecure Direct Object Reference
≤1.7.1069Update to 1.7.1070
CVE-2026-97255
Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
≤1.7.1069Update to 1.7.1070
CVE-2026-97254
Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
≤1.7.1069Update to 1.7.1070
CVE-2026-112865
Medium5.3Unauthenticated Unauthorized Email Relay
<1.7.1070Update to 1.7.1070
CVE-2026-106648
High8.8Authenticated (Contributor+) Remote Code Execution
≤1.7.1068Update to 1.7.1069
CVE-2026-111851
High7.2Unauthenticated Arbitrary HTML Injection in Notification Emails
≤1.7.1066Update to 1.7.1067
CVE-2026-13407
Medium5.3Unauthenticated Sensitive Information Exposure via Unfiltered meta_query LIKE Oracle in 'wpr_keyword' Parameter
≤1.7.1066Update to 1.7.1067
CVE-2026-17585
Medium5.3Missing Authorization
<1.7.1066Update to 1.7.1066
CVE-2026-13406
Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
<1.7.1066Update to 1.7.1066
CVE-2026-19226
Medium5.3Unauthenticated Like Count Manipulation
<1.7.1066Update to 1.7.1066
CVE-2026-13404
High7.2Authenticated (Administrator+) Remote Code Execution
<1.7.1066Update to 1.7.1066
CVE-2026-13405
High8.8Authenticated (Contributor+) Server-Side Request Forgery via Form Builder Widget 'webhook_url' Setting
≤1.7.1064Update to 1.7.1065
CVE-2026-17123
Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
≤1.7.1064Update to 1.7.1065
CVE-2026-19217
Medium5.3Unauthenticated Information Exposure
≤1.7.1062Update to 1.7.1063
CVE-2026-13402
Medium6.51.7.1059 - Authenticated (Contributor+) Arbitrary File Read via Data Table Widget CSV File Source
1.7.1058 – 1.7.1059Update to 1.7.1060
CVE-2026-8118
Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via 'title_tag' Parameter
≤1.7.1058Update to 1.7.1059
CVE-2026-6504
Medium5.3Missing Authorization
<1.7.1053Update to 1.7.1053
CVE-2026-25436
Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
<1.7.1053Update to 1.7.1053
CVE-2026-27421
Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via 'Follow Button Text' Parameter
≤1.7.1056Update to 1.7.1057
CVE-2026-5159
High7.2Unauthenticated Stored Cross-Site Scripting via 'status' Parameter in wpr_update_form_action_meta
≤1.7.1056Update to 1.7.1057
CVE-2026-4803
Medium5.3Missing Authorization to Unauthenticated Form Action Meta Modification
≤1.7.1056Update to 1.7.1057
CVE-2026-4024
High7.2Authenticated (Contributor+) Server-Side Request Forgery via CSV URL Parameter
≤1.7.1057Update to 1.7.1058
CVE-2026-6229
Medium6.4Authenticated (Author+) Stored Cross-Site Scripting via Image Caption Field
≤1.7.1056Update to 1.7.1057
CVE-2026-5428
Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via Instagram Feed Widget
≤1.7.1056Update to 1.7.1057
CVE-2026-5162
High7.2Unauthenticated Stored Cross-Site Scripting
<1.7.1041Update to 1.7.1041
CVE-2026-40720
Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via REST API Meta Bypass
≤1.7.1049Update to 1.7.1050
CVE-2026-0664
Medium5.3Missing Authorization
≤1.7.1056Update to 1.7.1057
CVE-2026-40763
Medium5.3Missing Authorization to Unauthenticated Custom Post Type Contents Exposure
≤1.7.1049Update to 1.7.1050
CVE-2026-2373
High8.8Authenticated (Author+) Arbitrary File Upload via main.php Upload Bypass
≤1.7.1049Update to 1.7.1050
CVE-2025-13067
Medium5.3Missing Authorization
≤1.7.1052Update to 1.7.1053
CVE-2026-28135
Medium5.3Missing Authorization to Unauthenticated Media File Upload
≤1.7.1036Update to 1.7.1037
CVE-2025-11363
Medium6.4Authenticated (Contributor+) DOM-Based Stored Cross-Site Scripting via lightGallery JavaScript Library
≤1.7.1031Update to 1.7.1032
CVE-2025-5092
Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
≤1.7.1036Update to 1.7.1037
CVE-2025-6251
Medium6.4Authenticated (Contributor+) Stored DOM-Based Cross-Site Scripting via Multiple Widgets
≤1.7.1028Update to 1.7.1029
CVE-2025-5338
Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
≤1.7.1020Update to 1.7.1021
CVE-2025-3813
Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
≤1.7.1017Update to 1.7.1018
CVE-2025-39361
Medium5.4Authenticated (Contributor+) Stored Cross-Site Scripting
≤1.7.1017Update to 1.7.1018
CVE-2024-12120
Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
≤1.3.977Update to 1.3.979
CVE-2025-39543
Medium5.5Authenticated (Admin+) Server Side Request Forgery
≤1.7.1006Update to 1.7.1007
CVE-2025-26990
Medium6.4Authenticated DOM-Based (Contributor+) Stored Cross-Site Scripting
≤1.7.1012Update to 1.7.1013
CVE-2025-1456
Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
≤1.7.1012Update to 1.7.1013
CVE-2025-1455
Medium6.1Cross-Site Request Forgery to Reflected Cross-Site Scripting
≤1.7.1007Update to 1.7.1008
CVE-2025-1441
Medium6.1Cross-Site Request Forgery to Reflected Cross-Site Scripting
≤1.7.1006Update to 1.7.1007
CVE-2025-0393
Medium6.1Reflected Cross-Site Scripting
≤1.7.1001Update to 1.7.1002
CVE-2024-56226
Medium4.3Missing Authorization
≤1.7.1001Update to 1.7.1002
CVE-2024-56227
Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
≤1.3.987Update to 1.7.1
CVE-2024-56062
Medium4.3Authenticated (Contributor+) Post Disclosure
≤1.7.1003Update to 1.7.1004
CVE-2024-10798
Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via Countdown Widget
≤1.7.1001Update to 1.7.1002
CVE-2024-9668
Medium6.4Authenticated (Contributor+) DOM-Based Stored Cross-Site Scripting via Form Builder Widget
≤1.7.1001Update to 1.7.1002
CVE-2024-9682
Medium6.4Authenticated (Contributor+) DOM-Based Stored Cross-Site Scripting via Google Maps Widget
≤1.7.1001Update to 1.7.1002
CVE-2024-9059
Medium5.4Authenticated (Author+) External Entity Injection
≤1.3.980Update to 1.3.981
CVE-2024-50442
Medium4.3Authenticated (Subscriber+) Private Post Disclosure
≤1.3.986Update to 1.3.987
CVE-2024-7417
Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via Team Member Widget
≤1.3.986Update to 1.3.987
CVE-2024-8482
Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
≤1.3.982Update to 1.3.985
CVE-2024-44001
Medium6.4Authenticated (Contributor+) DOM-Based Stored Cross-Site Scripting via Magazine Grid/Slider Widget
≤1.3.980Update to 1.3.981
CVE-2024-5818
Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
≤1.3.976Update to 1.3.977
CVE-2024-4488
Medium6.4Authenticated (Author+) Stored Cross-Site Scripting via SVG Uploads
≤1.3.976Update to 1.3.977
CVE-2024-4489
Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via Back to Top Widget
≤1.3.975Update to 1.3.976
CVE-2024-4087
Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
≤1.3.975Update to 1.3.976
CVE-2024-4342
Medium5.4Authenticated (Contributor+) Stored Cross-Site Scripting via Form Builder Widget
≤1.3.974Update to 1.3.975
CVE-2024-3887
Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via Advanced Accordion Title Tags
≤1.3.971Update to 1.3.972
CVE-2024-3889
Medium5.3Unauthenticated IP Spoofing
≤1.3.93Update to 1.3.95
CVE-2024-32786
Medium6.4Authenticated (Contributor+) DOM-Based Stored Cross-Site Scripting
≤1.3.971Update to 1.3.972
CVE-2024-2798
Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via HTML Tags
≤1.3.971Update to 1.3.972
CVE-2024-2799
Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via Flip Carousel, Flip Box, Post Grid, and Taxonomy List Widget Attributes
≤1.3.971Update to 1.3.972
CVE-2024-3675
High8.2Unauthenticated Limited File Upload
≤1.3.94Update to 1.3.95
CVE-2024-1567
Medium6.4Authenticated (Contributor+) Stored Cross-Site Scriting
≤1.3.93Update to 1.3.95
CVE-2024-31236
Medium5.4Authenticated (Contributor+) Stored Cross-Site Scripting via Logo Widget
≤1.3.91Update to 1.3.92
CVE-2024-1500
Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
≤1.3.87Update to 1.3.88
CVE-2024-0442
Medium4.3Cross-Site Request Forgery via remove_from_compare
≤1.3.87Update to 1.3.88
CVE-2024-0515
Medium4.3Cross-Site Request Forgery via wpr_update_form_action_meta
≤1.3.87Update to 1.3.88
CVE-2024-0511
Medium4.3Cross-Site Request Forgery via add_to_compare
≤1.3.87Update to 1.3.88
CVE-2024-0514
Medium4.3Cross-Site Request Forgery via add_to_wishlist
≤1.3.87Update to 1.3.88
CVE-2024-0512
Medium5.3Missing Authorization via wpr_update_form_action_meta
≤1.3.87Update to 1.3.88
CVE-2024-0516
Medium4.3Cross-Site Request Forgery via remove_from_wishlist
≤1.3.87Update to 1.3.88
CVE-2024-0513
Medium5.3Missing Authorization to Private/Password Protected Post Read
≤1.3.80Update to 1.3.81
CVE-2023-5922
Critical9.8Unauthenticated Arbitrary File Upload
≤1.3.78Update to 1.3.79
CVE-2023-5360
Medium4.3Cross-Site Request Forgery
≤1.3.75Update to 1.3.76
CVE-2022-47175
Medium6.1Reflected Cross-Site Scripting via fs_request_get
≤1.9.2No patch available
CVE-2023-33999
Medium5.3Unauthenticated MailChimp API Key Disclosure
≤1.3.70Update to 1.3.71
CVE-2023-3709
Medium4.3Insufficient Access Control to Template Kit Import
≤1.3.59Update to 1.3.60
CVE-2022-4709
Medium4.3Insufficient Access Control to Template Conditions Modification
≤1.3.59Update to 1.3.60
CVE-2022-4708
Medium4.3Insufficient Access Control to Menu Settings Update
≤1.3.59Update to 1.3.60
CVE-2022-4711
Medium6.1Reflected Cross-Site Scripting
≤1.3.59Update to 1.3.60
CVE-2022-4710
Medium5.4Insufficient Access Control to Plugin Deactivation
≤1.3.59Update to 1.3.60
CVE-2022-4702
Medium5.4Insufficient Access Control to Theme Activation
≤1.3.59Update to 1.3.60
CVE-2022-4700
Medium5.4Insufficient Access Control to Template Import
≤1.3.59Update to 1.3.60
CVE-2022-4704
Medium4.3Insufficient Access Control to Import Deletion
≤1.3.59Update to 1.3.60
CVE-2022-4703
Medium4.3Insufficient Access Control to Plugin Activation
≤1.3.59Update to 1.3.60
CVE-2022-4701
Medium4.3Cross-Site Request Forgery to Menu Template creation
≤1.3.59Update to 1.3.60
CVE-2022-4707
Medium4.3Insufficient Access Control to Template Activation
≤1.3.59Update to 1.3.60
CVE-2022-4705
High8.1Authenticated (Subscriber+) Arbitrary Post Deletion
≤1.3.55Update to 1.3.56
CVE-2022-4102
Medium6.5Missing Authorization to Subscriber+ Arbitrary Post Creation
≤1.3.55Update to 1.3.56
CVE-2022-4103
High8.1Cross-Site Request Forgery
≤1.3.55Update to 1.3.56
—
High8.8Cross-Site Request Forgery
≤1.3.55Update to 1.3.56
—
Medium6.3Missing Authorization Checks
all versionsNo patch available
CVE-2022-4974

Royal Addons for Elementor – Addons and Templates Kit for Elementor: common questions

Does Royal Addons for Elementor – Addons and Templates Kit for Elementor have known vulnerabilities?

Yes. VulnCrest Radar lists 101 known vulnerabilities in Royal Addons for Elementor – Addons and Templates Kit for Elementor: 1 critical, 12 high, 88 medium. At least one is not fixed in the latest version.

How do I check which version of Royal Addons for Elementor – Addons and Templates Kit for Elementor I run?

In wp-admin open Plugins → Installed Plugins; the version is shown under the name. Without admin access, our passive Check my site tool can often read it from public files.

What is the most recent Royal Addons for Elementor – Addons and Templates Kit for Elementor vulnerability?

CVE-2026-119519, published Nov 6, 2026: Royal Addons for Elementor – Addons and Templates Kit for Elementor <= 1.7.1068 - Missing Authorization. Severity: Medium (CVSS 4.3).

Is any Royal Addons for Elementor – Addons and Templates Kit for Elementor vulnerability listed in CISA KEV?

No. None of the known Royal Addons for Elementor – Addons and Templates Kit for Elementor vulnerabilities is currently listed in the CISA KEV catalog.

Search VulnCrest Radar

Jump to

Are you sure?