Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
1 selected

3 records

Release: Royal Addons for Elementor 1.7.1066 Clear all filters
TI-2026-15698 CVE-2026-19226 · GHSA-5xmp-jf4j-v6qw

Royal Elementor Addons < 1.7.1066 - Contributor+ Stored XSS via Image Accordion Widget Effect Settings

Priority LOW 32

The Royal Addons for Elementor WordPress plugin before 1.7.1066 does not validate some widget settings before outputting them inside an HTML attribute, which could allow users with the Contributor role and above to perfo…

CVSS 3.1MEDIUM 6.8 Network High privileges User interaction EPSS 0.00431 Published 2026-08-26 Fixed in 1.7.1066 CWE-79
TI-2026-11354 CVE-2026-13406 · GHSA-hmw6-r44j-8rx3

Royal Elementor Addons < 1.7.1066 - Unauthenticated Taxonomy Term Disclosure

Priority LOW 30

The Royal Addons for Elementor WordPress plugin before 1.7.1066 does not perform any capability or nonce check before returning taxonomy term data for an arbitrary, caller-supplied taxonomy, allowing unauthenticated user…

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.00323 Published 2026-08-26 Fixed in 1.7.1066 CWE-862
TI-2026-11352 CVE-2026-13404 · GHSA-v5xw-4p3j-4gfh

Royal Elementor Addons < 1.7.1066 - Unauthenticated Like Count and IP Meta Modification via wpr_likes_init

Priority LOW 30

The Royal Addons for Elementor WordPress plugin before 1.7.1066 does not perform any capability or ownership check (relying only on a publicly-scrapeable nonce) before writing like-count and visitor-tracking post meta ke…

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.00304 Published 2026-08-26 Fixed in 1.7.1066 CWE-639