Wproyal vulnerabilities
We track 14 vulnerabilities in Wproyal products across 4 products. 14 are rated high or critical, and none are known to be exploited. The most recent was published on October 22, 2026.
Latest Wproyal vulnerabilities
- 7.6 High severity
Royal Elementor Addons: Use of Externally-Controlled Input to Select Classes or Code
Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection') vulnerability in WProyal Royal Elementor Addons royal-elementor-addons allows Code Injection.This issue affects Royal Elementor Addons: from n/a through 1.7.1068.
- 8.8 High severity
Royal Addons for Elementor – Addons and…: Server-Side Request Forgery
The Royal Elementor Addons plugin for WordPress is vulnerable to Server-Side Request Forgery in versions up to, and including, 1.7.1064 via the Form Builder widget's 'webhook_url' setting. The widget's render() method persists the attacker-controlled URL into
- 7.2 High severity
Royal Addons for Elementor – Addons and…: Improper Neutralization of Input During Web Page Generation
The Royal Elementor Addons plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'status' parameter in the wpr_update_form_action_meta AJAX action in all versions up to, and including, 1.7.1056. This is due to insufficient input sanitizatio
- 7.2 High severity
Royal Addons for Elementor – Addons and…: Server-Side Request Forgery
The Royal Elementor Addons plugin for WordPress is vulnerable to Server-Side Request Forgery in versions up to, and including, 1.7.1057. This is due to insufficient validation of user-supplied URLs in the render_csv_data() function, which can be bypassed by in
- 7.5 High severity
News Magazine X: Missing Authorization
Missing Authorization vulnerability in wproyal News Magazine X news-magazine-x allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects News Magazine X: from n/a through <= 1.2.50.
- 8.8 High severity
Royal Addons for Elementor – Addons and…: Unrestricted Upload of File with Dangerous Type
The Royal Addons for Elementor plugin for WordPress is vulnerable to arbitrary file upload in all versions up to, and including, 1.7.1049. This is due to insufficient file type validation detecting files named main.php, allowing a file with such a name to bypa
- 7.5 High severity
News Magazine X: Improper Control of Filename for Include/Require Statement in PHP Program
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in wproyal News Magazine X news-magazine-x allows PHP Local File Inclusion.This issue affects News Magazine X: from n/a through <= 1.2.37.
- 8.8 High severity
Royal Addons for Elementor – Addons and…: Cross-Site Request Forgery
The Royal Elementor Addons and Templates plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.7.1007. This is due to missing or incorrect nonce validation on the 'wpr_filter_woo_products' function. This makes
- 9.8 Critical severity
Royal Elementor Addons: Authentication Bypass by Spoofing
Authentication Bypass by Spoofing vulnerability in WP Royal Royal Elementor Addons allows Functionality Bypass.This issue affects Royal Elementor Addons: from n/a through 1.3.93.
- 9.8 Critical severity
Royal Addons for Elementor – Addons and…: Unrestricted Upload of File with Dangerous Type
The Royal Elementor Addons and Templates plugin for WordPress is vulnerable to limited file uploads due to missing file type validation in the 'file_validity' function in all versions up to, and including, 1.3.94. This makes it possible for unauthenticated att
- 8.1 High severity
Royal Addons for Elementor – Addons and…: Improper Access Control
The Royal Elementor Addons plugin for WordPress is vulnerable to insufficient access control in the 'wpr_import_templates_kit' AJAX action in versions up to, and including, 1.3.59. This allows any authenticated user, including those with subscriber-level permi
- 8.1 High severity
Royal Addons for Elementor – Addons and…: Improper Access Control
The Royal Elementor Addons plugin for WordPress is vulnerable to insufficient access control in the 'wpr_reset_previous_import' AJAX action in versions up to, and including, 1.3.59. This allows any authenticated user, including those with subscriber-level perm
- 8.8 High severity
Royal Addons for Elementor – Addons and…: Improper Authorization
The Royal Elementor Addons plugin for WordPress is vulnerable to insufficient access control in the 'wpr_activate_required_plugins' AJAX action in versions up to, and including, 1.3.59. This allows any authenticated user, including those with subscriber-level
- 8.8 High severity
Royal Addons for Elementor – Addons and…: Improper Access Control
The Royal Elementor Addons plugin for WordPress is vulnerable to insufficient access control in the 'wpr_activate_required_theme' AJAX action in versions up to, and including, 1.3.59. This allows any authenticated user, including those with subscriber-level pe