Royal Addons For Elementor
Monthly
Stored Cross-Site Scripting in the Royal Addons for Elementor WordPress plugin (all versions before 1.7.1066) permits any authenticated Contributor-role user to inject arbitrary JavaScript payloads via unsanitized widget settings that are rendered unescaped inside HTML attributes. When a higher-privileged user such as an administrator previews or views the crafted content, the payload executes in their browser session, enabling session hijacking, credential theft, or unauthorized administrative actions. A public proof-of-concept is available via WPScan; however, no public exploit identified at time of analysis maps to confirmed active exploitation, and EPSS sits at 0.18% (8th percentile).
Unauthenticated information disclosure in Royal Addons for Elementor (WordPress plugin) before version 1.7.1066 exposes names and IDs of non-public taxonomy terms to any remote caller. The plugin performs no capability or nonce verification before fulfilling taxonomy data requests, meaning access controls enforced by WordPress core are entirely bypassed at the plugin layer. A publicly available proof-of-concept exists per WPScan, and exploitation is assessed as automatable with partial technical impact by the SSVC framework.
Unauthenticated metadata tampering in Royal Addons for Elementor WordPress plugin before 1.7.1066 allows any remote visitor to overwrite like-count and visitor-tracking post meta on arbitrary posts, including private and draft posts, because the plugin's AJAX handler validates only a nonce - a value scrapeable from any public page - without performing any WordPress capability or post-ownership check. A publicly available proof-of-concept exists per WPScan. While exploitation is automatable and requires no credentials, the integrity impact is narrow, limited to engagement metadata rather than post content or authentication data.
Arbitrary PHP code execution in Royal Addons for Elementor WordPress plugin (all versions before 1.7.1066) is reachable by any user holding the manage_options capability, including non-super subsite administrators on WordPress Multisite who would not otherwise have code-execution rights. The plugin writes unsanitized custom widget markup directly to a server-side file that is subsequently executed as PHP, enabling full server-side code injection. A publicly available exploit exists per WPScan; no CISA KEV listing at time of analysis, though the attack scenario is realistic for any WordPress Multisite deployment with delegated administration.
Stored Cross-Site Scripting in the Royal Addons for Elementor WordPress plugin (all versions before 1.7.1065) allows authenticated users holding the Contributor role or higher to inject persistent malicious scripts by supplying an unsanitized value in a widget setting that is written directly into an HTML tag. When a higher-privileged user such as an administrator subsequently views the affected page, the injected script executes in their browser session. A publicly available proof-of-concept exists and EPSS is 15%, placing this above the median exploitation probability for medium-severity WordPress plugin flaws.
Royal Addons for Elementor WordPress plugin before 1.7.1063 exposes private and draft Elementor template content to unauthenticated users through a REST endpoint that fails to enforce WordPress post-status access controls. Any unauthenticated visitor can retrieve rendered HTML of restricted templates referenced by non-public navigation menu items, bypassing intended content access controls. A public proof-of-concept exists per WPScan and SSVC flags this as automatable, though EPSS at 0.15% (4th percentile) reflects no confirmed widespread exploitation; no CISA KEV listing exists.
Stored Cross-Site Scripting in the Royal Addons for Elementor WordPress plugin (all versions before 1.7.1066) permits any authenticated Contributor-role user to inject arbitrary JavaScript payloads via unsanitized widget settings that are rendered unescaped inside HTML attributes. When a higher-privileged user such as an administrator previews or views the crafted content, the payload executes in their browser session, enabling session hijacking, credential theft, or unauthorized administrative actions. A public proof-of-concept is available via WPScan; however, no public exploit identified at time of analysis maps to confirmed active exploitation, and EPSS sits at 0.18% (8th percentile).
Unauthenticated information disclosure in Royal Addons for Elementor (WordPress plugin) before version 1.7.1066 exposes names and IDs of non-public taxonomy terms to any remote caller. The plugin performs no capability or nonce verification before fulfilling taxonomy data requests, meaning access controls enforced by WordPress core are entirely bypassed at the plugin layer. A publicly available proof-of-concept exists per WPScan, and exploitation is assessed as automatable with partial technical impact by the SSVC framework.
Unauthenticated metadata tampering in Royal Addons for Elementor WordPress plugin before 1.7.1066 allows any remote visitor to overwrite like-count and visitor-tracking post meta on arbitrary posts, including private and draft posts, because the plugin's AJAX handler validates only a nonce - a value scrapeable from any public page - without performing any WordPress capability or post-ownership check. A publicly available proof-of-concept exists per WPScan. While exploitation is automatable and requires no credentials, the integrity impact is narrow, limited to engagement metadata rather than post content or authentication data.
Arbitrary PHP code execution in Royal Addons for Elementor WordPress plugin (all versions before 1.7.1066) is reachable by any user holding the manage_options capability, including non-super subsite administrators on WordPress Multisite who would not otherwise have code-execution rights. The plugin writes unsanitized custom widget markup directly to a server-side file that is subsequently executed as PHP, enabling full server-side code injection. A publicly available exploit exists per WPScan; no CISA KEV listing at time of analysis, though the attack scenario is realistic for any WordPress Multisite deployment with delegated administration.
Stored Cross-Site Scripting in the Royal Addons for Elementor WordPress plugin (all versions before 1.7.1065) allows authenticated users holding the Contributor role or higher to inject persistent malicious scripts by supplying an unsanitized value in a widget setting that is written directly into an HTML tag. When a higher-privileged user such as an administrator subsequently views the affected page, the injected script executes in their browser session. A publicly available proof-of-concept exists and EPSS is 15%, placing this above the median exploitation probability for medium-severity WordPress plugin flaws.
Royal Addons for Elementor WordPress plugin before 1.7.1063 exposes private and draft Elementor template content to unauthenticated users through a REST endpoint that fails to enforce WordPress post-status access controls. Any unauthenticated visitor can retrieve rendered HTML of restricted templates referenced by non-public navigation menu items, bypassing intended content access controls. A public proof-of-concept exists per WPScan and SSVC flags this as automatable, though EPSS at 0.15% (4th percentile) reflects no confirmed widespread exploitation; no CISA KEV listing exists.